Edit tour

Windows Analysis Report
37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Overview

General Information

Sample name:	37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe
Analysis ID:	1466523
MD5:	c280b435ae8e9bcf43b221df43e9fc65
SHA1:	5185a39475de9e0b98f1faba04a9e3bf9e3d5d76
SHA256:	fa39d4dbbf0828f381cf30adfb6b5f3c207e86d22eccbfcc4d4ecd90573e4b6b
Tags:	exe
Infos:

Detection

LummaC, Poverty Stealer, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected LummaC Stealer

Yara detected Poverty Stealer

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Too many similar processes found

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe" MD5: C280B435AE8E9BCF43B221DF43E9FC65)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

DBD3.exe (PID: 7704 cmdline: C:\Users\user\AppData\Local\Temp\DBD3.exe MD5: BD2EAC64CBDED877608468D86786594A)

FD47.exe (PID: 7772 cmdline: C:\Users\user\AppData\Local\Temp\FD47.exe MD5: 60172CA946DE57C3529E9F05CC502870)

setup.exe (PID: 5236 cmdline: "C:\Users\user\AppData\Local\Temp\setup.exe" MD5: FF2293FBFF53F4BD2BFF91780FABFD60)

GamePall.exe (PID: 7564 cmdline: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1144 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3300 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5076 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3052 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3996 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3632 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171165647 --mojo-platform-channel-handle=4028 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7464 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171215235 --mojo-platform-channel-handle=4164 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2344 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7732 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7112 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6264 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4556 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7008 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5576 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1896 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5224 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3368 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5932 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5812 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1028 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6260 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7900 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6820 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7164 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2112 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 3020 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2484 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

1B6E.exe (PID: 7888 cmdline: C:\Users\user\AppData\Local\Temp\1B6E.exe MD5: DA4B6F39FC024D2383D4BFE7F67F1EE1)

GamePall.exe (PID: 5124 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6332 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

etvjrtf (PID: 7568 cmdline: C:\Users\user\AppData\Roaming\etvjrtf MD5: C280B435AE8E9BCF43B221DF43E9FC65)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-lummac2-94111d4b1e11	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "potterryisiw.shop"], "Build id": "bOKHNM--"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}

Threatname: Poverty Stealer

{"C2 url": "146.70.169.164:2227"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000006.00000003.2037792556.000000000169D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x234:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000003.2024545560.000000000169D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000003.2022920516.000000000169D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x634:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
Process Memory Space: DBD3.exe PID: 7704	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: DBD3.exe PID: 7704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DBD3.exe PID: 7704	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1B6E.exe PID: 7888	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.1B6E.exe.165ea20.1.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.1B6E.exe.165ea20.1.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.1B6E.exe.3cd0000.3.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.1B6E.exe.3cd0000.3.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.1B6E.exe.1618320.2.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.1B6E.exe.1618320.2.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\setup.exe, ProcessId: 5236, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GamePall

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\etvjrtf, CommandLine: C:\Users\user\AppData\Roaming\etvjrtf, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\etvjrtf, NewProcessName: C:\Users\user\AppData\Roaming\etvjrtf, OriginalFileName: C:\Users\user\AppData\Roaming\etvjrtf, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\etvjrtf, ProcessId: 7568, ProcessName: etvjrtf

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://foodypannyjsud.shop/api6	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/api2	Avira URL Cloud: Label: malware
Source: http://gebeus.ru/tmp/index.php	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/e	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/j	Avira URL Cloud: Label: malware
Source: http://cx5519.com/tmp/index.php	Avira URL Cloud: Label: malware
Source: contintnetksows.shop	Avira URL Cloud: Label: malware
Source: http://evilos.cc/tmp/index.php	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/ob	Avira URL Cloud: Label: malware
Source: ellaboratepwsz.xyz	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apid	Avira URL Cloud: Label: malware
Source: swellfrrgwwos.xyz	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/re1	Avira URL Cloud: Label: malware
Source: foodypannyjsud.shop	Avira URL Cloud: Label: malware
Source: https://foodypannyjsud.shop/apiW	Avira URL Cloud: Label: malware
Source: pedestriankodwu.xyz	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Avira: detection malicious, Label: HEUR/AGEN.1313486
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Avira: detection malicious, Label: HEUR/AGEN.1352426
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	Avira: detection malicious, Label: HEUR/AGEN.1359405

Found malware configuration

Source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://evilos.cc/tmp/index.php", "http://gebeus.ru/tmp/index.php", "http://office-techs.biz/tmp/index.php", "http://cx5519.com/tmp/index.php"]}
Source: 9.2.1B6E.exe.165ea20.1.raw.unpack	Malware Configuration Extractor: Poverty Stealer {"C2 url": "146.70.169.164:2227"}
Source: DBD3.exe.7704.6.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "potterryisiw.shop"], "Build id": "bOKHNM--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	ReversingLabs: Detection: 16%
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Roaming\etvjrtf	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Code function: 9_2_03CD1C94 CryptProtectData,

9_2_03CD1C94

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source:	Binary string: ntkrnlmp.pdbx, source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256f source: GamePall.exe, 0000000C.00000002.4716327288.00000000060B2000.00000002.00000001.01000000.00000014.sdmp, Newtonsoft.Json.dll.11.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbe source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: GamePall.exe, GamePall.exe, 0000000C.00000002.4716327288.00000000060B2000.00000002.00000001.01000000.00000014.sdmp, Newtonsoft.Json.dll.11.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbly source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000C.00000000.3173116453.00000000003B2000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 00000010.00000002.4666674998.0000000060139000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, 00000014.00000002.3264768163.0000000005952000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\*mp source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 00000014.00000002.3264768163.0000000005952000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 00000010.00000002.4666674998.0000000060139000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exemePalll source: setup.exe, 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb source: 1B6E.exe, 00000009.00000000.2135317082.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp, 1B6E.exe, 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: libGLESv2.dll.pdb source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3374106210.0000000000689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3374106210.0000000000689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbmw source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb. source: 1B6E.exe, 00000009.00000000.2135317082.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp, 1B6E.exe, 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1437

Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	7_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_004066FF FindFirstFileA,FindClose,	7_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_004027AA FindFirstFileA,	7_2_004027AA
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A924BD FindFirstFileExW,	9_2_00A924BD
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	11_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004066FF FindFirstFileA,FindClose,	11_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004027AA FindFirstFileA,	11_2_004027AA

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 181.52.122.51 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 141.8.192.126 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.68.16.7 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pedestriankodwu.xyz
Source: Malware configuration extractor	URLs: towerxxuytwi.xyz
Source: Malware configuration extractor	URLs: ellaboratepwsz.xyz
Source: Malware configuration extractor	URLs: penetratedpoopp.xyz
Source: Malware configuration extractor	URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor	URLs: contintnetksows.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: http://evilos.cc/tmp/index.php
Source: Malware configuration extractor	URLs: http://gebeus.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://office-techs.biz/tmp/index.php
Source: Malware configuration extractor	URLs: http://cx5519.com/tmp/index.php
Source: Malware configuration extractor	URLs: 146.70.169.164:2227

Source: Joe Sandbox View	IP Address: 141.8.192.126 141.8.192.126
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: TelmexColombiaSACO TelmexColombiaSACO
Source: Joe Sandbox View	ASN Name: SPRINTHOSTRU SPRINTHOSTRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: GamePall.exe, 00000028.00000002.3663716705.0000000003017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity
Source: GamePall.exe, 00000018.00000002.3894887215.00000000023F8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000019.00000002.3931428802.0000000002718000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 0000001C.00000002.3768604841.0000000002541000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 0000001D.00000002.3773257982.0000000002358000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000021.00000002.4013382785.00000000030B8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000022.00000002.4123152076.0000000003268000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity.0
Source: GamePall.exe, 00000028.00000002.3663716705.0000000003017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/installs
Source: GamePall.exe, 00000028.00000002.3663716705.0000000003017000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz
Source: GamePall.exe, 0000000C.00000002.3507088794.00000000027F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz/c/g
Source: GamePall.exe, 0000000C.00000002.3507088794.00000000027F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz/c/g4
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684623334.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: http://crbug.com/275944
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: http://crbug.com/497301
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: http://crbug.com/514696
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: http://crbug.com/717501
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: http://crbug.com/775961
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: http://crbug.com/839189
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684623334.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684623334.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: GamePall.exe, 0000000C.00000002.4777657271.0000000037F04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://groutchoay.com/
Source: GamePall.exe, 0000000C.00000002.4777657271.0000000037F04000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://groutchoay.com/7
Source: GamePall.exe, 0000000C.00000002.3507088794.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://groutchoay.com/?l=8pVpPBflecjcgHU
Source: GamePall.exe, 0000000C.00000002.4765285515.0000000037D68000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://groutchoay.com/?l=8pVpPBflecjcgHU&s=831805244739428353&z=6966849&tb=6424104&pz=6424105
Source: GamePall.exe, 0000000C.00000002.4757714643.0000000037C74000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://groutchoay.com/?l=8pVpPBflecjcgHU&s=831805244739428353&z=6966849&tb=6424104&pz=64241057
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: setup.exe, setup.exe, 0000000B.00000003.3173882874.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.2873916150.000000000040A000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: FD47.exe, 00000007.00000000.2074830237.000000000040A000.00000008.00000001.01000000.00000008.sdmp, FD47.exe, 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmp, setup.exe, 0000000B.00000003.3173882874.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.2873916150.000000000040A000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684623334.000000000982D000.00000004.00000001.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: explorer.exe, 00000001.00000000.1684248888.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1685237344.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1683896450.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: GamePall.exe, 0000000C.00000002.3507088794.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: GamePall.exe, 0000000C.00000002.4776026493.0000000037ECC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.apache.org/).
Source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: GamePall.exe, 00000010.00000002.3378641499.0000000006140000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: FD47.exe, 00000007.00000003.2077335796.00000000030D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.dat
Source: FD47.exe, 00000007.00000002.3536265180.00000000007A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.datf
Source: FD47.exe, 00000007.00000002.3536265180.00000000007A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.datlb
Source: FD47.exe, 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.datmCGBZvyfGQlwd
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1686438182.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1684623334.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1684623334.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1682187494.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1681641684.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1684623334.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1684623334.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1684623334.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: 1B6E.exe, 00000009.00000002.2833845596.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: 1B6E.exe, 00000009.00000002.2833845596.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/I
Source: 1B6E.exe, 00000009.00000002.2833845596.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2833845596.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/fcsdcvscvc/sadcasdv/raw/62af221cbc4d137cf4e95f7d66f3ced90597b434/kupee
Source: DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: GamePall.exe, 0000000C.00000002.4788856489.0000000056670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enCtrl$1
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ukCtrl$1
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=urCtrl$2
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=viCtrl$1
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: GamePall.exe, 0000000C.00000002.4788856489.0000000056670000.00000004.00001000.00020000.00000000.sdmp, GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: GamePall.exe, 0000000C.00000002.4788856489.0000000056670000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/declarativeNetRequestWithHostAccessapp.window.fullscreen.overrideE
Source: GamePall.exe, 0000000C.00000002.4787685561.000000005662C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: https://codereview.chromium.org/25305002).
Source: DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: https://crbug.com/1245093):
Source: GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	String found in binary or memory: https://crbug.com/1446731
Source: 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d136azpfpnge1l.cloudfront.net/;
Source: 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d301sr5gafysq2.cloudfront.net/
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664463768.000000000165D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2119386462.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2037792556.000000000169D000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076801213.00000000016B2000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2122102908.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076955432.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2097922295.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076766706.00000000016AC000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2023067511.000000000163F000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2022920516.000000000165B000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024545560.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/
Source: DBD3.exe, 00000006.00000003.2119386462.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2122102908.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2097922295.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/F9Q
Source: DBD3.exe, 00000006.00000003.2022920516.000000000165B000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2122082002.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024545560.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/api
Source: DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2022920516.000000000165B000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024545560.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/api2
Source: DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/api6
Source: DBD3.exe, 00000006.00000003.2119940512.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2122082002.00000000016A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apiW
Source: DBD3.exe, 00000006.00000003.2037792556.000000000169D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apid
Source: DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/bm/
Source: DBD3.exe, 00000006.00000003.2119386462.000000000163D000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2121863832.000000000163D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/e
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076801213.00000000016B2000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076955432.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076766706.00000000016AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/j
Source: DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/jhg
Source: DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/ob
Source: DBD3.exe, 00000006.00000003.2097922295.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/pi
Source: DBD3.exe, 00000006.00000003.2119386462.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2122102908.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/re1
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076801213.00000000016B2000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076955432.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076766706.00000000016AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/sG
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076801213.00000000016B2000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076955432.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076766706.00000000016AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/sc
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.com
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://passwords.google.comGoogle
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://passwords.google.comT
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://policies.google.com/
Source: explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664463768.000000000165D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664463768.000000000165D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: GamePall.exe, 0000000C.00000002.4776026493.0000000037ECC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: GamePall.exe, 0000000C.00000002.4759970266.0000000037CB8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=dummytoken
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: DBD3.exe, 00000006.00000003.2023916098.0000000003B8E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: DBD3.exe, 00000006.00000003.2024184644.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2023916098.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: DBD3.exe, 00000006.00000003.2024184644.0000000003B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: DBD3.exe, 00000006.00000003.2024184644.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2023916098.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: DBD3.exe, 00000006.00000003.2024184644.0000000003B60000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: GamePall.exe, 00000014.00000002.3256945805.0000000005526000.00000002.00000001.01000000.00000012.sdmp, GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1
Source: 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664463768.000000000165D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1686438182.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html&
Source: GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlT&r
Source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlYar&d
Source: DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: GamePall.exe, GamePall.exe, 0000000C.00000002.4716327288.00000000060B2000.00000002.00000001.01000000.00000014.sdmp, Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\FD47.exe

Code function: 7_2_004055E7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

7_2_004055E7

Source: GamePall.exe

Process created: 54

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

PE file has a writeable .text section

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: etvjrtf.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00401538 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401538
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00402FE9 RtlCreateUserThread,NtTerminateProcess,	0_2_00402FE9
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_004014DE NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004014DE
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00401496 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401496
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00401543 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401543
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00401565 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401565
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00401579 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401579
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_0040157C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_0040157C
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_100010D0 GetVersionExA,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,WideCharToMultiByte,lstrcmpiA,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenA,lstrcpynA,lstrcmpiA,CloseHandle,FreeLibrary,	7_2_100010D0

Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_004034CC
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		11_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_00406A88	7_2_00406A88
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A81490	9_2_00A81490
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A8D515	9_2_00A8D515
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A94775	9_2_00A94775
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A8BE09	9_2_00A8BE09
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_00406A88	11_2_00406A88
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_02564F58	12_2_02564F58
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_02561049	12_2_02561049
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_059F6608	12_2_059F6608
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_06A90790	12_2_06A90790
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_06A9D650	12_2_06A9D650
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63CE1D27	12_2_63CE1D27
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_635714C0	12_2_635714C0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63C44960	12_2_63C44960
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63D37460	12_2_63D37460
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63D37C50	12_2_63D37C50
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_61E89120	12_2_61E89120
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63CA4003	12_2_63CA4003
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_61D342A0	12_2_61D342A0

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Code function: String function: 00A80310 appears 51 times

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Static PE information: No import functions for PE file found
Source: etvjrtf.1.dr	Static PE information: No import functions for PE file found

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: etvjrtf.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Static PE information: Section .text
Source: etvjrtf.1.dr	Static PE information: Section .text

Source: Ionic.Zip.dll.11.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: Ionic.Zip.dll.11.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Ionic.Zip.dll.11.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: GamePall.exe.11.dr, Program.cs

Base64 encoded string: 'pizR9uKkcZIkMW+F1cRjYV0LMt6eYXmLuiNCndESDPkTO3eY1Mjv7Hs2Qvo+t26G', 'ZTDMzZVpdA1FSa2RiY6ZCl2QGyLDtQ3OBRa/N40wO2xxcvcDsATtLRGwKtaEB36dqPJnDF8qXNs92JbMBlsOyg==', 'nYQvMVlU2Asj2rNkmi7xBNqGCkGzSnaP0raCPfB8A9hSwWFTIjPcsKgDrCVAEwSQ1lHf/WOhnKR59a5JjrkJVUOFvV43wO8MM1FKgjYuj7ZzvvuGve+okViUQx+oGN+llGnjS4Fm9o1MUn7p+qcPVIDZRcvMal1ARjQNk+bFvT5vC4J8slkhLZYtvBYmOybvSK90G7/f/U8GPBdM7WBmfFdHzzGxw6WFcHlkdySP8Nvmzff08RdOn8QOu8FlABEqqEjQ0W84v+/lU0lmhvzugpodd8fIp2kb2/twZPg9/Jsy5viOC65K8bs1ES63SA2d62f5cJYpFf1f0WBQbCBcSzfwiDlBCWVIW9vFXW1awyEMdm3q36+BViyETC5tnyHuoLRgf3bXoQAwqE0OIII5DROfW+LmqqHY82rVXHAqhVjdA2wZRWcSI1zxV7+qTfhmp9qbIQAWSuuXTzhbIvI3gjvtPCdz9uBv8rjyg1XZNxfdgYdtF+klyGgKdefnu5G2pgjfT3Kb/VbjgkFvLlqtWNr5K7iC080FVeHsZazMHUrrDtsmNdChtvnX8Zj77rIGVxi9RfvHhhIhBj+WSos+lJ2nuvQkUpqVEa1mrZSwPezG/uoh0qvs+BAHbNFNjv99WS6tgWIkvcQVCi2h3cfxTGQiZDetQZqB+N/mnvgC6WdrcRKGHBE4mp6bpgTY9+nt3lPiH6OZnlxC8rdHbuGtY6R/FgNFYkw49JWXYeZ1VV3KnjSrFMvDlkyMCAW1X9/1VoC+f73WVYMLwXafDKtGO2lfr9vwKms+8HoEgs7bj0aroIPdmLK/z/djAsFZO8Vp', 'T7BWwqrn4yISEECEAnARpwE8R+3lDHSc+RlcJT90an1SNsS27lGBQjOx4RmDHlrj7oJnnzx1IWXOkbTfLzBeCfU6UJhOIoQKhcWidAxAKIxvqZnoB6AujIU0F7dEj65vahyTdEvkIxzFaV2+akbl53KcDi5RPBOP16iXVi0WJdHV5AbSCI9WCEcSX/fUpmukBh4bjVF/T/P/B6TFVtNZintCOSO2Ha+2va2CJMOnJ020zYskwuvcH9d1rGD3Zf9RBC2obzrhRNK2LXTEIYnifs6L2UdqFhw5aANXILziQtzKvsTQKvc15hvHCCoeXJCyyK7/WgA/oRu7bdrTs2DwCQ==', 'ZY0WCEgzqiLEU8ZUVJwGTpbkuL9KoMwYVloBqJXjur8rfBZEXTysQNKRQ1H7/vn7o0wyHAux60SVy06r4v6So5WWxddei09LXvL6ZwK/tyY=', 's7iS2XfzyI+IBoARaZQlTINg1kEy7qT7EopaSHQzpqktZBtc7UiOYrPdv/6f4cNI', 'o2ZleBui4P9C2ZjnB98Vuesy1C+WucHiXjQJ8RANoX6TheGfnLYAWDsXRfSeNCDHWdkBP2RBrkWPBy/nuM2NFLMETMUsPFeG3JHWafvGKzaNEjYO3Up9m61SnaY5tINvLCYJ/TKITszJ9H1YSm2chnmQGLUzbz4pwvWvvKfH8m7z585W73/QZrtw3l/30vcZaVocgwemYusDJYsOTgeWc0okiDahD7qtJcBYZ0aOzxZZmHDMBYigkRVf8GTJ/xucA/i7EHBFpaWoLVZVcuGFMA==', 'T7BWwqrn4yISEECEAnARp+JyVgG3cZc2/9+3VbyOjc4PuRSCU7ZfXuXpIIH8uj2roUU+W7nSmXHqTuxLhe6DBfNVh8PFZrhNX/YhIexDxrk=', 'G4TxOgdwfNBdU+6bscw2hqt3kZYZMfoEuKZtmCxRLrF8xJCK1+L0ocd8eSQjty7d', 'PcG64iM3U1vDIVDm7HuwTSvKhuz45f/WPqYoWZvzLHcapbEfkynZkUjmDgg30eof', 'XGcq7Js3+2f2oGHGFzxJPiYsrodwK+bTw/0lKjiUd0tSWMHEjdVqzAclD1/nPksq3sGhVTN8oFeHMRE7wAt3mCLVCEXKF9JLnNeWw9vvCbs=', 'T7BWwqrn4yISEECEAnARp8UQ6kvfa8mDiwe39obQZ+Rxfj5bbo//kf+4mlTsZUEg0QM/4QBKb6sUDMsk9OTdYg==', 'T7BWwqrn4yISEECEAnARp/U1NCwfjpQ4K5UKuMbDqXSrjfU6Tf/pOCpHlHXtYnU5', 'Gg/rFkGmnFrfPAny9sQ3qerPGxlC7+cuu92x2tgXrCRkqABwTbbIR8+hJN0krbBD9OJX8s2JqeR+xICuD2u17N7KjlWCZwpg4+c7mG1xAahALfXXbu/EvJy+KsAzQlzR9bu8P4wbyuM6r6/7kdf+VQ==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLT3pudJg4gGhcEax3IHwBI0R5vZR7J9mjUQ8R9MdKz/Fw==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLTcCwJrbTmNGWmZutw1Di2FSZ+3JxFtC00BiemuQuq2+A=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@273/116@0/8

Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		7_2_004034CC
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		11_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\FD47.exe

Code function: 7_2_00404897 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

7_2_00404897

Source: C:\Users\user\AppData\Local\Temp\FD47.exe

Code function: 7_2_00402173 CoCreateInstance,MultiByteToWideChar,

7_2_00402173

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\etvjrtf

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_rendLog.txt
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Mutant created: \Sessions\1\BaseNamedObjects\1e7f31ac-1494-47cc-9633-054c20e7432e
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_mainLog.txt

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\DBD3.tmp

Jump to behavior

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: DBD3.exe, 00000006.00000003.2024312683.0000000003B64000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe "C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\etvjrtf C:\Users\user\AppData\Roaming\etvjrtf
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DBD3.exe C:\Users\user\AppData\Local\Temp\DBD3.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FD47.exe C:\Users\user\AppData\Local\Temp\FD47.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1B6E.exe C:\Users\user\AppData\Local\Temp\1B6E.exe
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3300 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3996 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171165647 --mojo-platform-channel-handle=4028 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171215235 --mojo-platform-channel-handle=4164 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DBD3.exe C:\Users\user\AppData\Local\Temp\DBD3.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\FD47.exe C:\Users\user\AppData\Local\Temp\FD47.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\1B6E.exe C:\Users\user\AppData\Local\Temp\1B6E.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3300 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3996 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171165647 --mojo-platform-channel-handle=4028 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171215235 --mojo-platform-channel-handle=4164 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: mfsrcsnk.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: audioses.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscms.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: omadmapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dmcmnutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iri.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dsreg.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source:	Binary string: ntkrnlmp.pdbx, source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256f source: GamePall.exe, 0000000C.00000002.4716327288.00000000060B2000.00000002.00000001.01000000.00000014.sdmp, Newtonsoft.Json.dll.11.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbe source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEB9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: GamePall.exe, GamePall.exe, 0000000C.00000002.4716327288.00000000060B2000.00000002.00000001.01000000.00000014.sdmp, Newtonsoft.Json.dll.11.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbly source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000C.00000000.3173116453.00000000003B2000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 00000010.00000002.4666674998.0000000060139000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, 00000014.00000002.3264768163.0000000005952000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\*mp source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 00000014.00000002.3264768163.0000000005952000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 00000010.00000002.4666674998.0000000060139000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exemePalll source: setup.exe, 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb source: 1B6E.exe, 00000009.00000000.2135317082.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp, 1B6E.exe, 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: libGLESv2.dll.pdb source: setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3374106210.0000000000689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3374106210.0000000000689000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbmw source: 1B6E.exe, 00000009.00000002.2893422102.000000000AEC2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb. source: 1B6E.exe, 00000009.00000000.2135317082.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp, 1B6E.exe, 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmp

Source: Newtonsoft.Json.dll.11.dr

Static PE information: 0xF68F744F [Mon Jan 31 06:35:59 2101 UTC]

Source: C:\Users\user\AppData\Local\Temp\FD47.exe

Code function: 7_2_100010D0 GetVersionExA,LoadLibraryW,GetProcAddress,LocalAlloc,LocalAlloc,NtQuerySystemInformation,LocalFree,LocalAlloc,FreeLibrary,WideCharToMultiByte,lstrcmpiA,LocalFree,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenA,lstrcpynA,lstrcmpiA,CloseHandle,FreeLibrary,

7_2_100010D0

Source: initial sample

Static PE information: section where entry point is pointing to: .vmpLp

Source: chrome_elf.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x11ff85
Source: Del.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x556d
Source: libGLESv2.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x263106
Source: 1B6E.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x9498e
Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Static PE information: real checksum: 0xe07f should be: 0x194ea
Source: GamePall.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x5286e
Source: Uninstall.exe.11.dr	Static PE information: real checksum: 0x0 should be: 0x3fba6
Source: FD47.exe.1.dr	Static PE information: real checksum: 0x0 should be: 0x5633b
Source: INetC.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0xa6c6
Source: libEGL.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0x690e6
Source: blowfish.dll.7.dr	Static PE information: real checksum: 0x0 should be: 0x152a5
Source: Xilium.CefGlue.dll.11.dr	Static PE information: real checksum: 0x0 should be: 0xdde0b
Source: etvjrtf.1.dr	Static PE information: real checksum: 0xe07f should be: 0x194ea
Source: libGLESv2.dll0.11.dr	Static PE information: real checksum: 0x0 should be: 0x65b4a2

Source: DBD3.exe.1.dr	Static PE information: section name: .vmpLp
Source: DBD3.exe.1.dr	Static PE information: section name: .vmpLp
Source: DBD3.exe.1.dr	Static PE information: section name: .vmpLp
Source: libGLESv2.dll.11.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.11.dr	Static PE information: section name: .voltbl
Source: chrome_elf.dll.11.dr	Static PE information: section name: .00cfg
Source: chrome_elf.dll.11.dr	Static PE information: section name: .crthunk
Source: chrome_elf.dll.11.dr	Static PE information: section name: CPADinfo
Source: chrome_elf.dll.11.dr	Static PE information: section name: malloc_h
Source: libEGL.dll.11.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.11.dr	Static PE information: section name: .00cfg
Source: libcef.dll.11.dr	Static PE information: section name: .00cfg
Source: libcef.dll.11.dr	Static PE information: section name: .rodata
Source: libcef.dll.11.dr	Static PE information: section name: CPADinfo
Source: libcef.dll.11.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00408616 push eax; retf 0000h	0_2_00408619
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00401CD1 push ecx; ret	0_2_00401CD2
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_004084E6 push FFFFFFFBh; iretd	0_2_004084FC
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00401C91 push 00000076h; iretd	0_2_00401C93
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Code function: 0_2_00402E96 push B92A2F4Ch; retf	0_2_00402E9B
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A8004B push ecx; ret	9_2_00A8005E
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_62036B54 push ss; retf	12_2_62036B57
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63C458D2 push ebp; iretd	12_2_63C458D3
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63C4589C push ebp; iretd	12_2_63C4589D
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_63597138 push esp; ret	12_2_63597139
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_61DA38A9 push ecx; ret	12_2_61DA38AC
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 12_2_61E5A1BA push 83000004h; ret	12_2_61E5A1BF

Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Static PE information: section name: .text entropy: 7.062241098302679
Source: etvjrtf.1.dr	Static PE information: section name: .text entropy: 7.062241098302679
Source: Ionic.Zip.dll.11.dr	Static PE information: section name: .text entropy: 6.821349263259562

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FD47.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	File created: C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	File created: C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	File created: C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\etvjrtf	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DBD3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsiA896.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1B6E.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	File created: C:\Users\user\AppData\Local\Temp\setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\etvjrtf

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\etvjrtf:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_9-145697

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\etvjrtf	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\etvjrtf	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	API/Special instruction interceptor: Address: E87E15
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	API/Special instruction interceptor: Address: 9A76F5
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	API/Special instruction interceptor: Address: A84E89
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	API/Special instruction interceptor: Address: BB5B80
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	API/Special instruction interceptor: Address: AC522F
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	API/Special instruction interceptor: Address: B8F069

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: etvjrtf, 00000003.00000002.1923896582.00000000004E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK.
Source: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe, 00000000.00000002.1691660005.0000000000540000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2520000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 27A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 26A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1230000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 9A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 26E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 46E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1620000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3000000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1060000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 13D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2FB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4CE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 950000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 24A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3220000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5220000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3030000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5160000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 650000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 23D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 930000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 26F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 46F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 16F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1250000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: BF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: A70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2330000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 20C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 11F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4C90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: E40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 10C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1080000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 28D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 48D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 14D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1670000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2BB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4BB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1310000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 13D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2290000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 24F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 44F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1570000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2FC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1570000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 414	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 4639	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 891	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 369	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 878	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 868	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiA896.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

API coverage: 9.7 %

Source: C:\Windows\explorer.exe TID: 7320	Thread sleep time: -463900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7316	Thread sleep time: -89100s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7672	Thread sleep time: -36900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7676	Thread sleep time: -33400s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe TID: 7732	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 7644	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 7748	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 4168	Thread sleep count: 32 > 30

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	7_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_004066FF FindFirstFileA,FindClose,	7_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\FD47.exe	Code function: 7_2_004027AA FindFirstFileA,	7_2_004027AA
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A924BD FindFirstFileExW,	9_2_00A924BD
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	11_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004066FF FindFirstFileA,FindClose,	11_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004027AA FindFirstFileA,	11_2_004027AA

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Code function: 9_2_03CD2054 GetCurrentHwProfileA,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,

9_2_03CD2054

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior

Source: explorer.exe, 00000001.00000000.1685084391.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: DBD3.exe, 00000006.00000002.2121763571.00000000015FE000.00000004.00000020.00020000.00000000.sdmp, FD47.exe, 00000007.00000003.3383606451.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, FD47.exe, 00000007.00000003.3383411439.00000000007E0000.00000004.00000020.00020000.00000000.sdmp, FD47.exe, 00000007.00000002.3584082427.00000000007F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: explorer.exe, 00000001.00000000.1681641684.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1684623334.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684623334.000000000982D000.00000004.00000001.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2023067511.000000000163F000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2119386462.000000000163D000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2121863832.000000000163D000.00000004.00000020.00020000.00000000.sdmp, FD47.exe, 00000007.00000003.3383538487.000000000081D000.00000004.00000020.00020000.00000000.sdmp, FD47.exe, 00000007.00000002.3613821225.000000000081D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GamePall.exe, 00000027.00000002.3543813931.00000000006B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y`
Source: 1B6E.exe, 00000009.00000002.2833845596.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnS
Source: 1B6E.exe, 00000009.00000002.2833845596.00000000015AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn`
Source: explorer.exe, 00000001.00000000.1685084391.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: GamePall.exe, 0000000C.00000002.3351452366.0000000000803000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000001.00000000.1684623334.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1684623334.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1685084391.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1685084391.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: GamePall.exe, 00000027.00000002.3543813931.0000000000733000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: GamePall.exe, 00000027.00000002.3543813931.00000000006F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 3U7X`t Tt500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1684623334.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: GamePall.exe, 00000027.00000002.3543813931.00000000006F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:PP*7PXtxK
Source: explorer.exe, 00000001.00000000.1683280405.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: FD47.exe, 00000007.00000003.3383538487.000000000081D000.00000004.00000020.00020000.00000000.sdmp, FD47.exe, 00000007.00000002.3613821225.000000000081D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWA
Source: explorer.exe, 00000001.00000000.1684623334.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1681641684.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1681641684.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\FD47.exe	API call chain: ExitProcess graph end node			graph_7-3604
Source: C:\Users\user\AppData\Local\Temp\setup.exe	API call chain: ExitProcess graph end node			graph_11-3649

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Code function: 9_2_00A84383 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_00A84383

Source: C:\Users\user\AppData\Local\Temp\FD47.exe

7_2_100010D0

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Code function: 12_2_64094DA1 mov esi, dword ptr fs:[00000030h]

12_2_64094DA1

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Code function: 9_2_00A95891 GetProcessHeap,

9_2_00A95891

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A84383 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00A84383
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A80495 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00A80495
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A806F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00A806F0
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: 9_2_00A80622 SetUnhandledExceptionFilter,	9_2_00A80622

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 1B6E.exe.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 181.52.122.51 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 141.8.192.126 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.68.16.7 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 127.0.0.127 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.96.3 80	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Thread created: C:\Windows\explorer.exe EIP: 31419D0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Thread created: unknown EIP: 7DB19D0			Jump to behavior

LummaC encrypted strings found

Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: pedestriankodwu.xyz
Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: towerxxuytwi.xyz
Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: ellaboratepwsz.xyz
Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: penetratedpoopp.xyz
Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: swellfrrgwwos.xyz
Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: contintnetksows.shop
Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: foodypannyjsud.shop
Source: DBD3.exe, 00000006.00000002.2120635192.000000000065D000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: potterryisiw.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\etvjrtf	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3300 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3996 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171165647 --mojo-platform-channel-handle=4028 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171215235 --mojo-platform-channel-handle=4164 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3300 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3996 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171165647 --mojo-platform-channel-handle=4028 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171215235 --mojo-platform-channel-handle=4164 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3300 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3996 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171165647 --mojo-platform-channel-handle=4028 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (linux; android 10; k) applewebkit/537.36 (khtml, like gecko) chrome/126.0.6478.127 mobile safari/537.36" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171215235 --mojo-platform-channel-handle=4164 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1

Source: explorer.exe, 00000001.00000000.1683124534.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1684623334.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1681865280.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1681865280.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1681641684.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1681865280.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1681865280.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Code function: 9_2_00A8013C cpuid

9_2_00A8013C

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: GetLocaleInfoW,	9_2_00A8E096
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_00A950DC
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: EnumSystemLocalesW,	9_2_00A95051
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: GetLocaleInfoW,	9_2_00A9532F
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00A95458
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: GetLocaleInfoW,	9_2_00A9555E
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00A95634
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: EnumSystemLocalesW,	9_2_00A8DBC7
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	9_2_00A94CBF
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: EnumSystemLocalesW,	9_2_00A94FB6
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	Code function: EnumSystemLocalesW,	9_2_00A94F6B

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1B6E.exe

Code function: 9_2_00A8038F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_00A8038F

Source: C:\Users\user\AppData\Local\Temp\FD47.exe

Code function: 7_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

7_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: DBD3.exe, 00000006.00000003.2119386462.0000000001628000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2121863832.0000000001628000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: DBD3.exe PID: 7704, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 9.2.1B6E.exe.165ea20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.165ea20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.3cd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.3cd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.1618320.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.1618320.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1B6E.exe PID: 7888, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx LibertynDS
Source: DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1B6E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla\Notes9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\JSDNGYCOWY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DBD3.exe	Directory queried: C:\Users\user\Documents\UOOJJOZIRH	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1437

Source: Yara match	File source: 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2037792556.000000000169D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2024545560.000000000169D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2022920516.000000000169D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DBD3.exe PID: 7704, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: Process Memory Space: DBD3.exe PID: 7704, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 9.2.1B6E.exe.165ea20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.165ea20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.3cd0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.3cd0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.1618320.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.1B6E.exe.1618320.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1B6E.exe PID: 7888, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	1 Windows Service	1 Access Token Manipulation	111 Deobfuscate/Decode Files or Information	LSASS Memory	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Windows Service	31 Obfuscated Files or Information	Security Account Manager	137 System Information Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	312 Process Injection	2 Software Packing	NTDS	651 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	312 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	61%	ReversingLabs	Win32.Trojan.SmokeLoader
37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	100%	Avira	TR/Crypt.XPACK.Gen
37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\DBD3.exe	100%	Avira	HEUR/AGEN.1313486
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Avira	HEUR/AGEN.1352426
C:\Users\user\AppData\Local\Temp\setup.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Temp\FD47.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Temp\DBD3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1B6E.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\Del.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1B6E.exe	16%	ReversingLabs
C:\Users\user\AppData\Local\Temp\DBD3.exe	50%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\FD47.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiA896.tmp\liteFirewall.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\blowfish.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\nsProcess.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\setup.exe	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\GamePall\Del.exe	7%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libcef.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\log4net.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\etvjrtf	61%	ReversingLabs	Win32.Trojan.SmokeLoader

Source	Detection	Scanner	Label
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://crl.rootca1.amazontrust.com/rootca1.crl0	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
http://nsis.sf.net/NSIS_Error	0%	URL Reputation	safe
https://android.notify.windows.com/iOS	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	Avira URL Cloud	safe
https://support.google.com/chrome/answer/6098869	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/api6	100%	Avira URL Cloud	malware
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	0%	Avira URL Cloud	safe
http://api.install-stat.debug.world/clients/activity.0	0%	Avira URL Cloud	safe
https://aka.ms/odirmr	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/api2	100%	Avira URL Cloud	malware
https://www.google.com/chrome/privacy/eula_text.html	0%	Avira URL Cloud	safe
http://gebeus.ru/tmp/index.php	100%	Avira URL Cloud	malware
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	Avira URL Cloud	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=urCtrl$2	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/e	100%	Avira URL Cloud	malware
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	0%	Avira URL Cloud	safe
https://excel.office.com	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/j	100%	Avira URL Cloud	malware
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	0%	Avira URL Cloud	safe
http://unisolated.invalid/	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	0%	Avira URL Cloud	safe
https://photos.google.com/settings?referrer=CHROME_NTP	0%	Avira URL Cloud	safe
http://cx5519.com/tmp/index.php	100%	Avira URL Cloud	malware
https://passwords.google.com	0%	Avira URL Cloud	safe
https://aui-cdn.atlassian.com/	0%	Avira URL Cloud	safe
contintnetksows.shop	100%	Avira URL Cloud	malware
http://crbug.com/497301	0%	Avira URL Cloud	safe
http://groutchoay.com/	0%	Avira URL Cloud	safe
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	0%	Avira URL Cloud	safe
http://xiexie.wf/22_551/huge.datmCGBZvyfGQlwd	0%	Avira URL Cloud	safe
https://chromewebstore.google.com/declarativeNetRequestWithHostAccessapp.window.fullscreen.overrideE	0%	Avira URL Cloud	safe
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	0%	Avira URL Cloud	safe
http://bageyou.xyz	0%	Avira URL Cloud	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
http://evilos.cc/tmp/index.php	100%	Avira URL Cloud	malware
https://bitbucket.org/	0%	Avira URL Cloud	safe
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	0%	Avira URL Cloud	safe
https://wns.windows.com/L	0%	Avira URL Cloud	safe
http://crbug.com/839189	0%	Avira URL Cloud	safe
https://word.office.com	0%	Avira URL Cloud	safe
https://support.google.com/chromebook?p=app_intent	0%	Avira URL Cloud	safe
http://crbug.com/717501	0%	Avira URL Cloud	safe
http://xiexie.wf/22_551/huge.datlb	0%	Avira URL Cloud	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/ob	100%	Avira URL Cloud	malware
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	Avira URL Cloud	safe
https://www.google.com/chrome/privacy/eula_text.htmlT&r	0%	Avira URL Cloud	safe
ellaboratepwsz.xyz	100%	Avira URL Cloud	malware
https://www.google.com/chrome/privacy/eula_text.html&	0%	Avira URL Cloud	safe
http://groutchoay.com/?l=8pVpPBflecjcgHU&s=831805244739428353&z=6966849&tb=6424104&pz=6424105	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	0%	Avira URL Cloud	safe
http://xiexie.wf/22_551/huge.dat	0%	Avira URL Cloud	safe
http://groutchoay.com/?l=8pVpPBflecjcgHU	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/apid	100%	Avira URL Cloud	malware
swellfrrgwwos.xyz	100%	Avira URL Cloud	malware
http://crbug.com/514696	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	0%	Avira URL Cloud	safe
https://bitbucket.org/fcsdcvscvc/sadcasdv/raw/62af221cbc4d137cf4e95f7d66f3ced90597b434/kupee	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/re1	100%	Avira URL Cloud	malware
https://chrome.google.com/webstore?hl=ukCtrl$1	0%	Avira URL Cloud	safe
https://crbug.com/1446731	0%	Avira URL Cloud	safe
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	0%	Avira URL Cloud	safe
http://api.install-stat.debug.world/clients/installs	0%	Avira URL Cloud	safe
https://www.rd.com/list/polite-habits-campers-dislike/	0%	Avira URL Cloud	safe
https://support.microsof	0%	Avira URL Cloud	safe
foodypannyjsud.shop	100%	Avira URL Cloud	malware
https://www.newtonsoft.com/jsonschema	0%	Avira URL Cloud	safe
https://cdn.cookielaw.org/	0%	Avira URL Cloud	safe
https://foodypannyjsud.shop/apiW	100%	Avira URL Cloud	malware
pedestriankodwu.xyz	100%	Avira URL Cloud	malware
https://support.google.com/chrome/a/answer/9122284	0%	Avira URL Cloud	safe
https://chromewebstore.google.com/	0%	Avira URL Cloud	safe
https://outlook.com_	0%	Avira URL Cloud	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	Avira URL Cloud	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u	0%	Avira URL Cloud	safe
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://gebeus.ru/tmp/index.php	true	Avira URL Cloud: malware	unknown
http://cx5519.com/tmp/index.php	true	Avira URL Cloud: malware	unknown
contintnetksows.shop	true	Avira URL Cloud: malware	unknown
http://evilos.cc/tmp/index.php	true	Avira URL Cloud: malware	unknown
ellaboratepwsz.xyz	true	Avira URL Cloud: malware	unknown
swellfrrgwwos.xyz	true	Avira URL Cloud: malware	unknown
foodypannyjsud.shop	true	Avira URL Cloud: malware	unknown
pedestriankodwu.xyz	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1683280405.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/api2	DBD3.exe, 00000006.00000003.2037792556.000000000165C000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2022920516.000000000165B000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024545560.000000000165B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	GamePall.exe, 0000000C.00000002.4776026493.0000000037ECC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/api6	DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://api.install-stat.debug.world/clients/activity.0	GamePall.exe, 00000018.00000002.3894887215.00000000023F8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000019.00000002.3931428802.0000000002718000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 0000001C.00000002.3768604841.0000000002541000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 0000001D.00000002.3773257982.0000000002358000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000021.00000002.4013382785.00000000030B8000.00000004.00000800.00020000.00000000.sdmp, GamePall.exe, 00000022.00000002.4123152076.0000000003268000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/answer/6098869	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1684623334.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	GamePall.exe, 00000014.00000002.3256301243.00000000054E2000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/e	DBD3.exe, 00000006.00000003.2119386462.000000000163D000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2121863832.000000000163D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=urCtrl$2	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/j	DBD3.exe, 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076801213.00000000016B2000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076955432.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2076766706.00000000016AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unisolated.invalid/	GamePall.exe, 0000000C.00000002.4776026493.0000000037ECC000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
https://passwords.google.com	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aui-cdn.atlassian.com/	1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crbug.com/497301	GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
http://groutchoay.com/	GamePall.exe, 0000000C.00000002.4777657271.0000000037F04000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/declarativeNetRequestWithHostAccessapp.window.fullscreen.overrideE	GamePall.exe, 0000000C.00000002.4788856489.0000000056670000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1686438182.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xiexie.wf/22_551/huge.datmCGBZvyfGQlwd	FD47.exe, 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	GamePall.exe, 0000000C.00000002.3507088794.0000000002AEA000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://bageyou.xyz	GamePall.exe, 00000028.00000002.3663716705.0000000003017000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=ur&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bitbucket.org/	1B6E.exe, 00000009.00000002.2833845596.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1686438182.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chromebook?p=app_intent	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
http://crbug.com/717501	GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
http://crbug.com/839189	GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
http://xiexie.wf/22_551/huge.datlb	FD47.exe, 00000007.00000002.3536265180.00000000007A5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore	GamePall.exe, 0000000C.00000002.4788856489.0000000056670000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.rootca1.amazontrust.com/rootca1.crl0	DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	DBD3.exe, 00000006.00000003.2050013210.00000000016CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/ob	DBD3.exe, 00000006.00000003.2087019391.00000000016B6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	DBD3.exe, 00000006.00000003.2048454548.0000000003B4E000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2821062331.000000000AF1D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	DBD3.exe, 00000006.00000003.2024184644.0000000003B85000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2023916098.0000000003B8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	FD47.exe, 00000007.00000000.2074830237.000000000040A000.00000008.00000001.01000000.00000008.sdmp, FD47.exe, 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmp, setup.exe, 0000000B.00000003.3173882874.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.2873916150.000000000040A000.00000008.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/chrome/privacy/eula_text.html&	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/privacy/eula_text.htmlT&r	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://groutchoay.com/?l=8pVpPBflecjcgHU&s=831805244739428353&z=6966849&tb=6424104&pz=6424105	GamePall.exe, 0000000C.00000002.4765285515.0000000037D68000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	DBD3.exe, 00000006.00000003.2024480676.0000000003B5F000.00000004.00000800.00020000.00000000.sdmp, DBD3.exe, 00000006.00000003.2024611734.0000000003B48000.00000004.00000800.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2863419240.000000000A81F000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xiexie.wf/22_551/huge.dat	FD47.exe, 00000007.00000003.2077335796.00000000030D0000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://groutchoay.com/?l=8pVpPBflecjcgHU	GamePall.exe, 0000000C.00000002.3507088794.0000000002AFA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/apid	DBD3.exe, 00000006.00000003.2037792556.000000000169D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DBD3.exe, 00000006.00000003.2049741742.0000000003C57000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crbug.com/514696	GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
https://bitbucket.org/fcsdcvscvc/sadcasdv/raw/62af221cbc4d137cf4e95f7d66f3ced90597b434/kupee	1B6E.exe, 00000009.00000002.2833845596.00000000015A0000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000002.2833845596.00000000015ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 00000010.00000002.3970596633.0000000006C20000.00000002.00000001.00040000.0000001D.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 0000000B.00000003.3173882874.00000000006E9000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.2873916150.000000000040A000.00000008.00000001.01000000.0000000E.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore?hl=tr&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://crbug.com/1446731	GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/re1	DBD3.exe, 00000006.00000003.2119386462.00000000016B4000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2122102908.00000000016B4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chrome.google.com/webstore?hl=ukCtrl$1	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.install-stat.debug.world/clients/installs	GamePall.exe, 00000028.00000002.3663716705.0000000003017000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.microsof	DBD3.exe, 00000006.00000003.2023916098.0000000003B8E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.cookielaw.org/	1B6E.exe, 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664327299.0000000001620000.00000004.00000020.00020000.00000000.sdmp, 1B6E.exe, 00000009.00000003.2664386169.0000000001623000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.newtonsoft.com/jsonschema	Newtonsoft.Json.dll.11.dr	false	Avira URL Cloud: safe	unknown
https://foodypannyjsud.shop/apiW	DBD3.exe, 00000006.00000003.2119940512.00000000016A7000.00000004.00000020.00020000.00000000.sdmp, DBD3.exe, 00000006.00000002.2122082002.00000000016A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chromewebstore.google.com/	GamePall.exe, 0000000C.00000002.4788856489.0000000056670000.00000004.00001000.00020000.00000000.sdmp, GamePall.exe, 0000000F.00000002.4113180925.000000000672C000.00000002.00000001.00040000.0000001E.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/a/answer/9122284	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1683280405.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000001.00000000.1686438182.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	DBD3.exe, 00000006.00000003.2024184644.0000000003B60000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore?hl=uk&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000B.00000002.3374533199.0000000002737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1683280405.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
181.52.122.51	unknown	Colombia	10620	TelmexColombiaSACO	true
185.166.143.48	unknown	Germany	16509	AMAZON-02US	false
141.8.192.126	unknown	Russian Federation	35278	SPRINTHOSTRU	true
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	true
172.67.221.174	unknown	United States	13335	CLOUDFLARENETUS	false
185.68.16.7	unknown	Ukraine	200000	UKRAINE-ASUA	true
146.70.169.164	unknown	United Kingdom	2018	TENET-1ZA	true

Private

IP
127.0.0.127

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466523
Start date and time:	2024-07-03 01:31:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@273/116@0/8
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 74% Number of executed functions: 256 Number of non-executed functions: 99
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Connection to analysis system has been lost, crash info: Normal
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Execution Graph export aborted for target DBD3.exe, PID 7704 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Simulations

Behavior and APIs

Time	Type	Description
00:32:15	Task Scheduler	Run new task: Firefox Default Browser Agent D09C45E3FF9BCB4C path: C:\Users\user\AppData\Roaming\etvjrtf
00:34:25	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
00:34:35	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
19:32:01	API Interceptor	137558x Sleep call for process: explorer.exe modified
19:32:29	API Interceptor	9x Sleep call for process: DBD3.exe modified
19:34:29	API Interceptor	1x Sleep call for process: GamePall.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
181.52.122.51	file.exe	Get hash	malicious	Babuk, Djvu	Browse	cajgtus.com/lancer/get.php?pid=3C8DAB0A318E3BBE55D6418C454BF200&first=true
141.8.192.126	http://a0748987.xsph.ru	Get hash	malicious	Unknown	Browse	a0748987.xsph.ru/favicon.ico
188.114.96.3	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	sp.26skins.com/favicon.ico
	30Fqen2Bu3.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/TbaYPT0S/download
	30Fqen2Bu3.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/TbaYPT0S/download
	Vg46FzGtNo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	000366cm.nyashka.top/phpflowergenerator.php
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/mHgyHEv5/download
	file.exe	Get hash	malicious	FormBook	Browse	www.cavetta.org.mt/yhnb/
	http://johnlewisfr.com	Get hash	malicious	Unknown	Browse	johnlewisfr.com/
	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	445798cm.nyashka.top/ProviderEternalLinephpRequestSecurePacketprocessauthwordpress.php
	http://www.youkonew.anakembok.de/	Get hash	malicious	HTMLPhisher	Browse	www.youkonew.anakembok.de/cdn-cgi/challenge-platform/h/g/jsd/r/89b98144d9c843b7
	hnCn8gE6NH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	yenot.top/providerlowAuthApibigloadprotectflower.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPRINTHOSTRU	OBbrO5rwew.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	SecuriteInfo.com.Win32.DropperX-gen.32377.19302.exe	Get hash	malicious	LummaC, Poverty Stealer, SmokeLoader	Browse	141.8.192.126
	https://kawak.com.co	Get hash	malicious	Unknown	Browse	185.251.91.91
	S#U0435tup.exe	Get hash	malicious	CopperShrimp	Browse	185.185.70.98
	S#U0435tup.exe	Get hash	malicious	CopperShrimp	Browse	185.185.70.98
	file.exe	Get hash	malicious	SmokeLoader	Browse	141.8.192.6
	https://www.asarco.com/	Get hash	malicious	Unknown	Browse	185.251.91.91
	email.eml	Get hash	malicious	HTMLPhisher	Browse	176.119.147.86
	8TFewUGOYv.exe	Get hash	malicious	DCRat	Browse	141.8.192.26
	setup.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, SmokeLoader, Stealc	Browse	141.8.192.6
CLOUDFLARENETUS	https://rules-pear-kft5d2.mystrikingly.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	http://sp.26skins.com/steamstore/category/adventure_rpg/?snr=1_5_9__12	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://steaemcoonmmunnltly.com/g-friend/golo/gifts-50	Get hash	malicious	Unknown	Browse	104.17.25.14
	0cjB1Kh8zU.msi	Get hash	malicious	Unknown	Browse	172.67.149.157
	http://business.ifbsmetaiidentiityconfirms.com/meta-community-standard100068928266341/	Get hash	malicious	Unknown	Browse	188.114.96.3
	http://services.business-manange.com/	Get hash	malicious	Unknown	Browse	172.67.138.117
	http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://pub-1b634168cd404e2d8bece63d5ebb4798.r2.dev/uint.html?schweissdoors	Get hash	malicious	HTMLPhisher	Browse	104.26.10.155
	https://pub-9445ce0d74714d1c934c51ffcf83c3f2.r2.dev/slnt.html?nycsbs	Get hash	malicious	HTMLPhisher	Browse	104.26.10.155
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	172.67.69.226
TelmexColombiaSACO	mirai.m68k.elf	Get hash	malicious	Mirai	Browse	181.55.9.109
	lQC7IiMNX1.elf	Get hash	malicious	Mirai	Browse	186.145.37.75
	205.185.121.21-mips-2024-07-01T10_13_50.elf	Get hash	malicious	Mirai, Moobot	Browse	181.63.52.236
	GIW8jzBGQQ.elf	Get hash	malicious	Mirai, Moobot	Browse	181.56.164.145
	g75NqH852l.elf	Get hash	malicious	Mirai, Moobot	Browse	190.146.237.77
	V7UaNBrX72.elf	Get hash	malicious	Mirai, Moobot	Browse	190.159.39.101
	sIfZJVVv1H.elf	Get hash	malicious	Mirai, Moobot	Browse	190.85.145.143
	botx.x86.elf	Get hash	malicious	Mirai	Browse	190.146.4.233
	35bf9dfd223e02da2ee3d57ec493156787a3c2cecb8b655a583985a2f14cc6e3_dump.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	190.147.128.172
	gErAvW63Ax.elf	Get hash	malicious	Mirai	Browse	190.147.222.233
AMAZON-02US	https://rules-pear-kft5d2.mystrikingly.com/	Get hash	malicious	Unknown	Browse	13.224.189.122
	https://metamesklogni.webflow.io/	Get hash	malicious	Unknown	Browse	108.156.2.28
	http://pub-2e7429ed1f544f43a4684eeceb978dbb.r2.dev/home.html	Get hash	malicious	Unknown	Browse	18.239.94.85
	http://helpdesk-advertising-review-id-9865133.d3m7n55z273utf.amplifyapp.com/index.html	Get hash	malicious	Unknown	Browse	108.138.7.41
	https://delivery.attempt.failure.ebbs.co.za/public/MY096OineFzTCVJ56qDw3aMDByE0CDQ1	Get hash	malicious	Unknown	Browse	13.227.219.28
	http://review-page-violation-issue-meta-center.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.93
	https://supp-review9482.eu/	Get hash	malicious	Unknown	Browse	18.245.31.129
	http://cacahs.fdavm.com/	Get hash	malicious	Unknown	Browse	108.156.60.57
	SecuriteInfo.com.Adware.DownwareNET.4.16171.10714.exe	Get hash	malicious	Unknown	Browse	18.239.69.105
	http://mysterymint-s10.vercel.app/	Get hash	malicious	Unknown	Browse	76.76.21.98

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD47.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1B6E.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	578048
Entropy (8bit):	6.297510031778876
Encrypted:	false
SSDEEP:	12288:No4ykJuqlLJop9G3/AmAGWn7sfPJYQIMt8KHsTH:NoBsLaDKAmAbUJ+M2K2
MD5:	DA4B6F39FC024D2383D4BFE7F67F1EE1
SHA1:	7CC975D9FF785E269163897907D0B9B3CEE29956
SHA-256:	544697A024ABAEA1B24EAA3D89869B2C8A4C1ACF96D4E152F5632D338D054C9E
SHA-512:	D73CC4D911D9E61711B97CB9212D5BC93CB1B1314A39945934EB92239A31728FCCA7FEFBEC0143BAD915B0A7A6B93DF11D0AB7F559737AA7EC920BD24243FFFE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I..I..I...1..I...1...I...1..I..l...I..l...I..l....I...1..I..I...I..]...I..]...I..Rich.I..................PE..L...w;.f...............'.....\....................@.......................................@.....................................(................................2..Xh..p....................i.......g..@...............@............................text....~.......................... ..`.rdata..4...........................@..@.data...............................@....reloc...2.......4..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DBD3.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6642176
Entropy (8bit):	7.866419732571782
Encrypted:	false
SSDEEP:	98304:LqhZ67opwYckx35SF2XKgxVvHuCPU8GSbO3JAXV1LrA+ZlL9CxpzTp2:LgErupSgKORuCT43JeV1LE+/s3p
MD5:	BD2EAC64CBDED877608468D86786594A
SHA1:	778AD44AFD5629F0A5B3B7DF9D6F02522AE94D91
SHA-256:	CAE992788853230AF91501546F6EAD07CFD767CB8429C98A273093A90BBCB5AD
SHA-512:	3C8F43045F27ADDCB5FB23807C2CE1D3F247CC30DD1596134A141B0BBC7FA4D30D138791214D939DC4F34FD925B9EC450EA340E5871E2F4F64844226ED394312
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....U~f..............................M...........@...................................e...@..................................O......P......................@.......................................................@3..............................text...+........................... ..`.rdata...*..........................@..@.data.... ..........................@....vmpL.p.....0...................... ..`.vmpL.p@....@3.....................@....vmpL.p..]..P3...]................. ..`.reloc.......@........].............@..@.rsrc.......P...f....].............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FD47.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	293869
Entropy (8bit):	5.61569579822855
Encrypted:	false
SSDEEP:	3072:lFi6z/VXzAf3ocMNqB3r1Josf+OMhERMlm+twHBumSYyDgIoIPM7l0UGHM7:lxFSIjs+OM2eLFmSFgIZk7+HM7
MD5:	60172CA946DE57C3529E9F05CC502870
SHA1:	DE8F59D6973A5811BB10A9A4410801FA63BC8B56
SHA-256:	42CEB2252FEC41FD0ACC6874B41C91E0BA07C367045D6A9A7850D59781C2584C
SHA-512:	15D37AF3CAB96FC9026A1898E09C775FE0D277098A3FE20C2E591272DE996A243850D43F3B48B4C037C5FED359E57795A7CF1652547D7AD8B16B186AB9508792
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........`..X............................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...X....`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiA896.tmp\liteFirewall.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.389604568119155
Encrypted:	false
SSDEEP:	1536:Dli3i1jKfTV0LzYpAzMk2nACScLw5jPAT:j9KLQ+ScLw5jPAT
MD5:	165E1EF5C79475E8C33D19A870E672D4
SHA1:	965F02BFD103F094AC6B3EEF3ABE7FDCB8D9E2A5
SHA-256:	9DB9C58E44DFF2D985DC078FDBB7498DCC66C4CC4EB12F68DE6A98A5D665ABBD
SHA-512:	CD10EAF0928E5DF048BF0488D9DBFE9442E2E106396A0967462BEF440BF0B528CDF3AB06024FB6FDAF9F247E2B7F3CA0CEA78AFC0CE6943650EF9D6C91FEE52A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W=.e9n.e9n.e9n...n.e9n...n.e9n..Bn.e9n.e8n.e9n.7.n.e9n...n.e9n...n.e9n...n.e9nRich.e9n........PE..L...,.N...........!.........^.......%...............................................3..................................`...$'..d....`.......................p...................................... ...@...............h............................text...1........................... ..`.rdata..P/.......0..................@..@.data........0......................@....rsrc........`.......*..............@..@.reloc.......p.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskFDD3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD47.exe
File Type:	data
Category:	dropped
Size (bytes):	60466
Entropy (8bit):	5.603640719549413
Encrypted:	false
SSDEEP:	1536:akqg31kqY3Q4Oc//////Q0LatojW/lX1Xb41:3qg323Sc//////Q3tojW/XXy
MD5:	DE806154A80E3916669C466B6D001BD6
SHA1:	B85BD0EC436125772A9C5403162628B7AAB35F49
SHA-256:	10D9B7F2238EFFEB71990F979B9DFE4F3BE3D212B05232EF34C39F9578CC11E3
SHA-512:	63CC5D6865C89AE2C41EEE3C76FD865D9461E96DBC570270982EB6DB5A15FB234098286CEE3FF9DB2255FEDA5207A222AB67743475AD60CCFD89A86B881BCB94
Malicious:	false
Reputation:	unknown
Preview:	",......,..................."...\|%......H+......",..............................................................................................................................................................................................................................................................j.......,.../...5.......3.......................................................................................................................N.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD47.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\blowfish.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD47.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.674611218414922
Encrypted:	false
SSDEEP:	384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5:	5AFD4A9B7E69E7C6E312B2CE4040394A
SHA1:	FBD07ADB3F02F866DC3A327A86B0F319D4A94502
SHA-256:	053B4487D22AACF8274BAB448AE1D665FE7926102197B47BFBA6C7ED5493B3AE
SHA-512:	F78EFE9D1FA7D2FFC731D5F878F81E4DCBFAF0C561FDFBF4C133BA2CE1366C95C4672D67CAE6A8BD8FCC7D04861A9DA389D98361055AC46FC9793828D9776511
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................6..........dD.......P....@.....................................................................Y.......................................p...................................................................................CODE....\|4.......6.................. ..`DATA....8....P.......:..............@...BSS..........p.......L...................idata...............L..............@....edata..Y............P..............@..P.reloc..p............R..............@..P.rsrc................V..............@..P.....................X..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD47.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.666004851298707
Encrypted:	false
SSDEEP:	48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5:	FAA7F034B38E729A983965C04CC70FC1
SHA1:	DF8BDA55B498976EA47D25D8A77539B049DAB55E
SHA-256:	579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
SHA-512:	7868F9B437FCF829AD993FF57995F58836AD578458994361C72AE1BF1DFB74022F9F9E948B48AFD3361ED3426C4F85B4BB0D595E38EE278FEE5C4425C4491DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n\|f.L...I...Q...@..K...@..H...@..H...RichI...........PE..L...`..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..`............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz3A0C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	358363995
Entropy (8bit):	6.972150585647623
Encrypted:	false
SSDEEP:	3145728:KTzytRGD/CYRNIPKYTFBhfmOS9KBaVzTx9OSsKV97nM:KnUs4tvaVzTD99M
MD5:	5F9D89B40243E83C0B48206CE4EB77D1
SHA1:	477A019AB11E5793168B3E41D83B80A8AC8F1D43
SHA-256:	2BF31800E731EF63E7E5BDEECD87B50B349EC8F5C9D752AACB807AC0E82E95B9
SHA-512:	5B812C2D341FE8A9296EF68E416E0EFA8185FB3ECCEC0917AB206CD7639E1810E6444538B61583E2260F1A46D4209E1995CFBF940A1D9836C4155ADF0504940B
Malicious:	false
Reputation:	unknown
Preview:	........,.......................H...........................................................................................................................................................................................................................................................e...i...............j.......................3.......................................................................................................................t....V..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\FD47.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlQGt:Ls3
MD5:	2CB33C36023AE8970F1A8FECC4D15840
SHA1:	22763BCBDF379493B386FA113D00494A6651511B
SHA-256:	B0D5B6F3459A06524561B89016AA57921ED4FE6C2E72A156E52EAE374D128250
SHA-512:	54F3035DD23CA7E7F7EE93F30F53C642252D612BF6D711FFE0705B796F8C6089C04FB558561527181AA7EEFF37EDC466E10D1D35DF04A76FE9626AAF0DFA3DC2
Malicious:	false
Reputation:	unknown
Preview:	.........................................*...z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Del.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.622398838808078
Encrypted:	false
SSDEEP:	96:QPjzIyfbInD3W0IwrBmEH7UewW4ORIhmY5XO40uK8DDzNt:pQIS0IwrJbU7W4kIX5e4kgF
MD5:	97D4D47D539CB8171BE2AEFD64C6EBB1
SHA1:	44ABF82DD553CCE0C1F41B9B78D853075DDD1F16
SHA-256:	8D996D5F68BF2248F223C4F3549303BC6A8EC58CC97FCB63B7BB7D8068850273
SHA-512:	7D402847B093E208410C695095DE815A3F5D5DA81630FD51C88C009C48C269D0EA5016D626351BB9D38862163FAD930645072C50ACCCD743DC0E19531A592FDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.].........."...0.............64... ...@....@.. ....................................@..................................3..O....@.......................`.......2............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........#...............1...............................................0..-.......(....r...p(.....(.......(....,...(....(........0..T........~....(.....~....(.....(....s....%.o....%.o....%.o....%.o....%~....o....(....&..&..........PP.......0..6.......(....(......( ...r...p~....r...p(!.....("...,...(#......0..........r...p.~$.....o%.....,..~....o&......,..o'....ra..p.~$.....o%.....,..~....o(......,..o'....r...p.~$.....o%.....,..~....o(......,..o'......&..*....4.......#..

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlopa/:Ls3op
MD5:	3FEC6BEC64ED7962401AADCBD0CEB2DC
SHA1:	DD9F30C733CDBDB816D9FB5C1DAA750E56ECBF3A
SHA-256:	9399F6ED1663E0D4C5B1EE6A4675DFB98647830722E95A74133E2C2A89CE4F60
SHA-512:	5500BAFD4EAA6350A44AF1FE8DA52847127071117FD498D657265006DB4651C64AD3C5365FF5951ACB6A38D20E6170D2CAA30EEA4FD574AF55C126E4A4B66835
Malicious:	false
Reputation:	unknown
Preview:	........................................P....z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	5.660420770467009
Encrypted:	false
SSDEEP:	3072:xTpjI4TptgvmHMaellnhblkK0m2QEk0xjo4OVzdvayfvYn6A:ppbVtsg1e5b2Px2zdyyq
MD5:	7A3502C1119795D35569535DE243B6FE
SHA1:	DA0D16BC66614C7D273C47F321C5EE0652FB5575
SHA-256:	B18FEFB56ED7B89E45CEC8A5494FBEC81E36A5CB5538CCBB8DE41CCE960FAA30
SHA-512:	258B111AC256CD8145CBE212D59DFF5840D67E70EFFD7CDDC157B2A3461B398BBC3446004980131FAA6A8762C19305F56E7B793F045331B56B8BD17D85B884C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rf..............0.............>.... ........@.. ....................................@....................................O.......t............................................................................ ............... ..H............text...d.... ...................... ..`.rsrc...t...........................@..@.reloc..............................@..B................ .......H....... ...$...........D...p............................................(....s....Z..(....,...(....(.....(......(......(............~........0..W.......(....".....(......,..o....-...o.....+...( .....o....&..(!...-...........o"....."...BZ.......%..A.......0..Q.......(....(........,..o....-...o.....+...( .....o....&.._...(!...-...........o"..............!. A.......0..V.......(....(......,..o....-.~#.....o.....+...( ...."...B[..o....&..(!...-...........o"....*......

C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462336
Entropy (8bit):	6.803831500359682
Encrypted:	false
SSDEEP:	6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
MD5:	6DED8FCBF5F1D9E422B327CA51625E24
SHA1:	8A1140CEBC39F6994EEF7E8DE4627FB7B72A2DD9
SHA-256:	3B3E541682E48F3FD2872F85A06278DA2F3E7877EE956DA89B90D732A1EAA0BD
SHA-512:	BDA3A65133B7B1E2765C7D07C7DA5103292B3C4C2F0673640428B3E7E8637B11539F06C330AB5D0BA6E2274BD2DCD2C50312BE6579E75C4008FF5AE7DAE34CE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=N...........!................N#... ...@....@.. ..............................T.....@.................................."..O....@..P....................`......."............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................0#......H.......0U..l...........P%.../..P ......................................6..`N.?O...%.C.k_..d...I......5a.......9x......R...gg8...JM...`.[. .o..eE1$_.M.h.q.oz..1..........@....s.c/J..wk.D.....t..&...(.......0..2........r...p(....}.......}"....(........(.........(......r...p(....}.......}"....(........(......0..j.........o....-..s#...+..}......(......(......}.....(....s....}......}......}......(......%-.&r...p}......j(#...rr!..p.{.....{.....B...(....*..0..A........{..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	574376
Entropy (8bit):	5.8881470355864725
Encrypted:	false
SSDEEP:	12288:ZzfhypmNGgHA37YyUD1AboTf3xnpJbC8VGSBJjRuz7:ZoI1AbQf3xnpJbC8VLBJjRuz7
MD5:	8F81C9520104B730C25D90A9DD511148
SHA1:	7CF46CB81C3B51965C1F78762840EB5797594778
SHA-256:	F1F01B3474B92D6E1C3D6ADFAE74EE0EA0EBA6E9935565FE2317686D80A2E886
SHA-512:	B4A66389BF06A6611DF47E81B818CC2FCD0A854324A2564A4438866953F148950F59CD4C07C9D40CC3A9043B5CE12B150C8A56CCCDF98D5E3F0225EDF8C516F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ot............" ..0.............6.... ........... ....................................@....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........f...P............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{E....3...{D......(....,...{D.....{F.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	561424
Entropy (8bit):	4.606896607960262
Encrypted:	false
SSDEEP:	6144:XqqUmk/Rik2rH6dl0/IaHNpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUK
MD5:	928ED37DB61C1E98A2831C8C01F6157C
SHA1:	98103C2133EBDA28BE78BFE3E2D81D41924A23EE
SHA-256:	39F6A4DB1BE658D6BAFF643FA05AAE7809139D9665475BFCA10D37DCA3384F21
SHA-512:	F59387BFA914C7DB234161E31AD6075031ACA17AAEF4B8D4F4B95C78C7A6A8D0E64211566CA2FD4549B9DA45231F57A4191FBCD3809404653F86EE2ABD4937A4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	215862
Entropy (8bit):	5.849338245796311
Encrypted:	false
SSDEEP:	3072:rFi6z/VXzAf3oc8+vat7fvYnDAdOVz5kNx:rxFSI+y1qk6zuNx
MD5:	9D21A25AA1B5985A2C8CBCE7F7007295
SHA1:	86EBF56352B4DBB831FAE0CCA180B4ADD951240D
SHA-256:	E41F984C39183BA4FD1578134D71E203F4A7A8C23F278924562876326FC40EE2
SHA-512:	EE4A1AC97968F2DDA3C54A49AC33D3FCE28C4DAE72032D9FDD1F8D8BA41B07A1D78D15E11586DA54AD5E0F2BD4A48C79A0CBAC84DE3D957B2AC6C1B5F41A33BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	875520
Entropy (8bit):	5.621956468920589
Encrypted:	false
SSDEEP:	12288:jsRfnBqqvFXWesd2HiZ9fyn+5FHrvUR1Qnzx7LuQ:jsRITeWAQ5vtu
MD5:	B03C7F6072A0CB1A1D6A92EE7B82705A
SHA1:	6675839C5E266075E7E1812AD8E856A2468274DD
SHA-256:	F561713347544E9D06D30F02A3DFCEC5FE593B38894593AEEDF5700666B35027
SHA-512:	19D6792EB9BA8584B94D0D59E07CE9D1C9C4DA5516490F4ABCE5AE0D7D55B357BDA45B2093B3E9EB9D6858061E9D3F530A6655C4779A50C911501AE23925C566
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ....................................@..................................p..O.......x............................o..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc...x............T..............@..@.reloc...............Z..............@..B.................p......H....... .................................................................(......(......(....^.(.......=...%...}....:.(......}....:.(......}....^.(.......>...%...}....:.(......}.....(.............0..,.......(....o.......3......... ....3.(....-.....0..L.......~..... . ..(......(....-..(....r...p( ...,.......&...~....(!...,..("..............+1...........4.......~.....~......(.....~....,..(#...-.(....-..(....+.r...ps$...z(..........b.r...p(%...~.....(....&*.r

C:\Users\user\AppData\Roaming\GamePall\cef.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1946739
Entropy (8bit):	7.989700491058983
Encrypted:	false
SSDEEP:	49152:fpXzD2VLpS71ycdao6LreGCL/0jJZWOiBiXkbEia9T:xjyFgZ0Lr2/0jJU5BiIEN
MD5:	96AD47D78A70B33158961585D9154ECC
SHA1:	149BF6F6905A76B0CC9E9ACA580357BD6C3497A2
SHA-256:	C861117D1F1DBF02867B46FA87CB8C65C3213D196029EE81A02B617D131236E2
SHA-512:	6A971F742B5754EEF39C6C2C64DB13DFDCB74D8CB23833404E9EF5AD89E142278E5DF789F508DB561C5E957013AE0C60D002CDFA93BCD87CA4967D610DF1579B
Malicious:	false
Reputation:	unknown
Preview:	........V...f.....g.7........................!.....%....o8...).>...).F...).H...).X...).a...)i...).k...).q...)Lt...).v...)Tw...).x...).}...).....)I....)i....)....).....).....)L....)....)....)t....).....).....).....)s....).... )....!)....")....#)....$)}...%)+...&)h#..').'..().-..)).>..).A..+).C..,).Q..-)CU...).]..<).d..=).l..>)i...?)G...@)H...A)r...B)....C)z...T)....U)....V)+...W)....X)....Y)....Z)....[)#...\)}...]).!..^)R1.._).2..`).;..a).=..b)mE..c)QG..d).H..e)qL..f).U..g).]..h).b..i))d..j).e..k).g..l)Pi..m).p..n).z..s).z...).....)b....).....)'....).....)....)....).....).....)....).....)s....)F....)j....)....).....)....)....)....)h....)H....)....).....).....)k....).....)L....)q....)2....).....).....).....).....).....)N....)\|....).....).....).....).!...).)...).6...).C...)RE...).L...).N...).O...).U...)bV...).W...).^...)o_...)(g...)Si...).v...).....)0....)/....).....),....)..........F....]....3....v........v...................$... ....!8..."....#....$....%*..

C:\Users\user\AppData\Roaming\GamePall\cef_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	214119
Entropy (8bit):	7.955451054538398
Encrypted:	false
SSDEEP:	6144:m5S+8U5mtp0ra7rFrJzw95T9OHCZg0Gb0OveGe04mExhLY:mWU5OGUFoqoORehrQ
MD5:	391F512173ECEC14EB5CE31299858DE1
SHA1:	3A5A41A190C1FB682F9D9C84F500FF50308617FC
SHA-256:	E0F5C754C969CCA0AC4594A6F3F2C23D080A09EEA992AF29E19F4291FD1E0B06
SHA-512:	44D7B9BCB3544C3F5550150EF3522BF6A0B36900695E6A13E44F5616E16A058548189D4FEA4A22248B1CB2B273B0EAA7D559EB2D8F013BED520E4097BD45D800
Malicious:	false
Reputation:	unknown
Preview:	........................#.b...&.....:.g....7.....7.....7.....7\|(...7.-...7t5...7.6...7.9...7s:...7hB...7.E...7.G...7.K...7qN...7.Q...7yR...7.S...7.W...7.\...7.b...7.i...7.k...76m...7Vq...7.r...7.v...7.y...7.{...7.~...7Z....75....7;....7W....7.....7c....7u....7b....7.....7.....7.....7Q....7*....7\....8."...8,)..<FqG..=F7I..>F.L..?F$O..@F.P..AFaQ..BFnT..CF.W..DF.Y..EFJ\..FF.^..MF(b..NF.c..QF.e..RF.f..YFZg..ZF.p..[F.x..\F.{..]F.{...L.\|...L.....L....Ni....N.....NJ....N2....N+....N^....No....N9....NK....N....N1....N$....N....Nh....N.....N.....U.....U.....U.....U.....U.....U[....U.&...Uh(...U?/...U.4...U.:...U.@...U.B...U,G...U.K...U)N...U.R...UF\...U.`...U.b...U.j...U]s...UEt...U.u...U.w...U.z...Uh{...U.}...U#....U.....U^....U.....U\|....U.....U.....U.....U.....U.....U.....U.....U.....U.....U]....U?....U.....U9....U....U.....Um....U<....U!....U.....U.....U....Uq....U3....U!....U.....U....U.....Uu....UJ....U.....U.....U.....U.....U`....U'....U.....U.....Ul....U%....U7....U.....U.....UW.

C:\Users\user\AppData\Roaming\GamePall\cef_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	290001
Entropy (8bit):	7.9670215100557735
Encrypted:	false
SSDEEP:	6144:tS+8U5mtp0ra7rFriDQYaF+9bQHgs4jTlmOHCZVWGMRe8InVXYopym74:CU5OGUFrfs4gs4jTQ6ebVIo374
MD5:	BF59A047984EAFC79E40B0011ED4116D
SHA1:	DF747125F31F3FF7E3DFE5849F701C3483B32C5E
SHA-256:	CD9BE67AA0527F16E309189FA2369E1A2596D0601A7D55C405F8A619F4D095E9
SHA-512:	85A545758E8C89EF47BF11B553C57D23ED7DA6AE89A8BCCB262F509AABE61A1121C3F87EC9200791F2670225BAEECC3C92AED6AFDA86C08CA0FD611DA2E595D2
Malicious:	false
Reputation:	unknown
Preview:	........................#.....&.....:......7.....7.....7.....7.+...7.1...7.8...7.9...7)<...7.=...7xE...7.H...7.J...7'N...7.Q...7.T...7.U...7.W...7.Z...7._...7.e...7.l...7.n...7Fp...7ft...7.v...7)y...7.\|...7.~...7.....7j....7E....7K....7g....7.....7s....7.....7r....7.....7.....7.....7a....7:....7l"...8.%...8<,..<F.J..=F.N..>FtV..?F9\..@Fw_..AFr`..BF0g..CFll..DF\|o..EF.v..FF){..MF....NF...QFf...RF....YF`...ZF...[F....\F....]F....L....L.....L.....N.....N.....N.....N.....N.....N.....N.#...N.&...N.'...N.)...N....N.+...Nv,...N.-...N;r...N.\|...Um....U.....UM....UV....U.....U....UC....U.....U....UM....U.....U.....Um....U.....U.....U.....U.....UQ....U.....U7....U.....U.....Uk....U.....U.....U.....U.....U.....U.....U.....U.....U.....U{....U.....U.....U.....U~&...U.)...U.Q...U.Q...U.V...U.[...U.\...U._...U.`...U?a...U.a...Uic...U.d...U\f...U.g...U.i...U1l...U.p...U.u...U.}...U.....U.....U^....U.....U.....Ux....U....U.....Uy....U6....U.....U....UR....Uq....U.....U.....U_....U.....U.....U..

C:\Users\user\AppData\Roaming\GamePall\cef_extensions.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1305142
Entropy (8bit):	7.99463351416358
Encrypted:	true
SSDEEP:	24576:8AkckSbnVLjWG13xdT0b+SLzRYt2k+lbG9EjJNH/osm22O+EcRfPLP:88zVXWG1hdAKSxY4k5EFNHgvPPLP
MD5:	20DDA02AF522924E45223D7262D0E1ED
SHA1:	378E88033A7083AAC24E6CD2144F7BC706F00837
SHA-256:	8448C2BA10A3D7DC8CA3FB24F580BF99D91F746107B1A06E74932749CC1CAB01
SHA-512:	E71320B2AA0CB52938206EC00187D78274646C4C7D3579B33A0163262C063B7813FE7ACD0D2E5807082ADE772069AA577FED7F594964790C2F7C061CE38467B6
Malicious:	false
Reputation:	unknown
Preview:	........i...f+....i+....l+....m+{...n+q...o+7(..p+.1..q+X3..r+~5..s+aI..t+.]..u+.f..v+Ui..w+'k..x+.l..y+.q..z+.s..{+O{..\|+...}+=...~+.....+....+-....+.....+.....+.....+.....+.....+.....+.....+.....+.....+%....+.....+&(...+.Q...+.Y...+Xe...+Bj...+cv...+.}...+....+H....+....+Q....+l....+I....+.....+ ....+T....+!....+m....+.....+.....+U....+.....+.....+.....+l....+~....+.....+=....+w....+.....+-"...+.(...+.0...+.2...+.4...+.G...+uS...+.....+9....+y....+.....+.....+N....+....+0....+.....+.....+.....+_....+.....+.....+.....+.....+.....+.....+.....+.....+S....7`....7R...(7/...)7.....L.m...LO....L.....Mk....M.....M.....M>....M.....M.....Mq....M.....M.....M\....M.....M.....M.....M.....M.....M.....M.....M.....M.....MO....M.....M.....M.!...M.(...Mf5...M.;...M&E...M.P...M.T...M<]...M.`...M.j.. M.k..!M2v.."M.w..#M.z..$M....%M...&M...'M#...(M@...)M....*M(...+MY...,Mu...-M$....M..../MV...0M;...1Mx...2M....3M....4Mi...5M....6M....7MP...8M"...DM....EM.....Mi....M.~...M.~...Mb....M_....M....M.

C:\Users\user\AppData\Roaming\GamePall\cef_sandbox.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	87182312
Entropy (8bit):	5.477474753748716
Encrypted:	false
SSDEEP:	196608:v0b1XAJ5V8XYcrfCNJsTtU0ZhdYHbgMnn6d25JOcLRiLnIrBcnK0EAeg1GF:78JaNJyZhdE6383rWEAR8
MD5:	FFD456A85E341D430AFA0C07C1068538
SHA1:	59394310B45F7B2B2882D55ADD9310C692C7144F
SHA-256:	F188B96639B5157E64222BB8483D76CD21A99141FC2614EF275E20639C739264
SHA-512:	EB4CB388383CB37B1D89531D560169985A80DF9335F005AFBBFDE56F9031821A933D735138B1086CF81D006E480FF14711A8A95B3DB8A0FD4037AA6EFD926B50
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 1696073295 0 1940897 `...Y..:.t.:.>.:...:...:...:...:...;/..;/..;/..;/..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..@...@...@...@...@...A...A...A...A...A...A...A...A...A...A...A...A...Co..Co..Co..Co..Co..Co..Co..Co..Co..Co..E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...G..G..G..G..G..G..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=.

C:\Users\user\AppData\Roaming\GamePall\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	656926
Entropy (8bit):	7.964275415195004
Encrypted:	false
SSDEEP:
MD5:	3404DD2B0E63D9418F755430336C7164
SHA1:	0D7D8540FDC056BB741D9BAF2DC7A931C517C471
SHA-256:	0D3FCA7584613EB1A38BAF971A7DD94F70803FC130135885EC675E83D16A4889
SHA-512:	685D63633DB8A57D84225C2B92C92016E1CE98BA2BF8D3DDACE2EB120B3BCF84C718787D59DB6EC61F34CF91CB651500B4E4FF0AC37AEB89561CDCC586946C80
Malicious:	false
Reputation:	unknown
Preview:	..........+...........................&..........;.....;N....;.....;"....;.....;.....;N....;.....;.....;s....;....;.....;.....;....;4....;.....;.....;0....;.....;c....;7....;.....;.....;.....;.....;?....;:....;G....;.....;n....;x....;.....;.....;.....;#....;.....;.....;B....;.....;.....;.....;N....;.....;.....;+....;.....;% ...;c!...;.!...;."...;E+...;t4...;qH...;I\...;.]...;.^...;>a...;.c...;.g...;.o...;pw...;.\|...;h....;.....;.....;....;.....;....;o....;.....;.....;.....;....;y....;.....;.....;3....;9....;h....;.....;.....;.....;F....;."...;.+...;.0...;.8...;?:...;'X...;.q...;.....;....;.....;t....;.....;.....;.....;./...;.X...; m...;....;.....;.....;.....;+....;.....<O....<.....<.....<=....<2$...<y+...<.3...<.<...<aA...<.L...<.W...<.[...<._...<.d...<Dv...<t....<!....<....<....<.....<.....<.....<V....<.....<.#...<.8...<\|F...<hP...<bW.. <i^..!<ts.."<(...#<{...)<`...<c...+<d...,<"...;<x...<<k...=<....><-...?<....@<....A<'...B<g...C<....D<U...E<....F<....G<....J<....K<....L<v%

C:\Users\user\AppData\Roaming\GamePall\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1017158
Entropy (8bit):	7.951759131641406
Encrypted:	false
SSDEEP:
MD5:	3FBF52922588A52245DC927BCC36DBB3
SHA1:	EF3C463C707A919876BF17C3E1CD05C0D2C28CA9
SHA-256:	C6FE346106C5E4950161ED72EB0A81FE3537A94E4A59461AAF54E750D1904F76
SHA-512:	682EB6D61B564C878FDB971A6439FCDA9F1E108BD021A32E8990B68B1338986A4866A0965DEA62567501C8826D43CEBF2B7C8BE8323DE415A75E8D89A9D592E7
Malicious:	false
Reputation:	unknown
Preview:	..........+.....................b................;.....;&....;.....;.....;.....;.....;b....;....;8....;.....;.....;o....;....;<....;.....;.....;l....;....;/....;.....;[....;Q....;.....;j....;.....;.....;L'...;.E...;lZ...;.o...;.q...;.r...;.s...;.{...;.{...;.~...;"....;.....;U....;.....;.....;.....;....;d....;.....;.....;i....;.....;f....;....;0....;.....;.....;.(...;+...;.+...;A....;54...;.9...;,O...;.`...;.n...;.~...;.....;.....;M....;....;;....;q....;Z....;.....;.....;.-...;\=...;.P...;.d...;@\|...;.....;Y....;#....;_....;/....;.....;.#...;.;...;.J...;gc...;cf...;W....;....;W....;.....;.....;.....;7....;.-...;.I...;Y\...;W....;....;.....;S....;.....;t....;.....;.....<W....<.&...<9<...<iG...<jQ...<.X...</a...<gi...<.n...<Pz...<.....<f....<.....<I....<.....<.....<.....<4C...<4d...<....<....<.....<.....<.....<D8...<.e...<_....<....<.... <I...!<...."<.E..#<.E..)<.G..<%j..+<N...,<....;<....<<v...=<....><....?<....@<y...A<....B<....C<....D<....E<"F..F<.J..G<.O..J<.X..K<.e..L<.r

C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1174528
Entropy (8bit):	6.475826085865088
Encrypted:	false
SSDEEP:
MD5:	207AC4BE98A6A5A72BE027E0A9904462
SHA1:	D58D2C70EA0656D81C627D424F8F4EFCCEF57C86
SHA-256:	2BA904DA93ACC4766639E7018AC93CC32AA685DB475F3A59B464C6BC8B981457
SHA-512:	BFB6C58774829DB3D5FADC92CB51477FF4EAC8FB934DB6583A312BB1157468F6DD3A4A3AFAF25A687B74890DC8A69857A12D0B38B18D83E82836E92E02046FF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....v...p......P.....................................................@A........................vT......AX..<.......x...........................<<.......................;......(...............<[.......O.......................text....u.......v.................. ..`.rdata..\............z..............@..@.data...H...........................@....00cfg...............F..............@..@.crthunk.............H..............@..@.tls.................J..............@...CPADinfo(............L..............@...malloc_h.............N.............. ..`.rsrc...x............P..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4127200
Entropy (8bit):	6.577665867424953
Encrypted:	false
SSDEEP:
MD5:	3B4647BCB9FEB591C2C05D1A606ED988
SHA1:	B42C59F96FB069FD49009DFD94550A7764E6C97C
SHA-256:	35773C397036B368C1E75D4E0D62C36D98139EBE74E42C1FF7BE71C6B5A19FD7
SHA-512:	00CD443B36F53985212AC43B44F56C18BF70E25119BBF9C59D05E2358FF45254B957F1EC63FC70FB57B1726FD8F76CCFAD8103C67454B817A4F183F9122E3F50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!7P.OdP.OdP.Od..NeR.OdP.Nd..OdY..dU.Od.Jem.Od.KeQ.Od...dQ.Od..Leo.Od..Je..Od..OeQ.Od..Ge..Od..Kec.Od...dQ.Od..MeQ.OdRichP.Od................PE..L..................!.....2<..*...............P<...............................?.......?...@A.........................<<.u.....=.P.....=.@.............>..%....=.........T....................u..........@.............=..............................text...e0<......2<................. ..`.data...`"...P<......6<.............@....idata........=.......<.............@..@.rsrc...@.....=.......<.............@..@.reloc........=.......<.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\devtools_resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	2205743
Entropy (8bit):	7.923318114432295
Encrypted:	false
SSDEEP:
MD5:	54D4E14BFF05C268248CAB2EEDFB61DD
SHA1:	33AF472176F6E5FB821FFE23C9FBCCC7C735B5B9
SHA-256:	2CAC401BFFA9FD4DFFE11E05EE18FC5CA7A30EC5BF7EF6A3EA8518A4F3344790
SHA-512:	5A6893E7EA30EAA0EFF44687B0D15366A8224E476E4AE8FE0D5C7EF2B3C62E6B0184F73EAD36C4E4E08D6936524CEF8429660B3EC29453EED128E3C5368CE78C
Malicious:	false
Reputation:	unknown
Preview:	........K....[.....[.....[.....[Y....[.....[.....[.....[.....[P ...[.!...[."...[.#...[.$...[.%...[.%...[T&...[0'...[/(...[.(...[.(...[....[.+...[{,...[1-...[.-...[3....[b/...[.0...[.1...[.2...[.3...[,4...[.4...[P5...[.5...[#6...[!8...[.8...[.9...[.9...[::...[q;...[Y=...[.=...[ ?...[.@...[0A...[iB...[?D...[.E...[pE...[UF...[.G...[.H...[)I...[.I...[.M...[.M...[DN...[.N...[FO...[.O...[.Q...[oV...[uW...[cX...[[\...[.]...[Ea...[bc...[.c...[ d...[.d...[oe...[.f...[.h...[.i...[Xj...[.k...[.l...[An...[.o...[.p...[.....[....[.....[.....[.....[.....[[!...[.%...[d....[x1...[.4...[.4...[.9...[.C...[.Q...[KS...[#V...[=]...\.b...\.z...\Q}...\.....\.....\....\`....\.^...\7b...\uy...\g....\.....\.....\=....\....\....\....\'....\.....\....\.... \....!\...."\....$\....%\....&\....)\....\....+\.Q..,\.S..-\.U...\..../\w...0\....1\8...2\....3\....4\....5\....6\....7\.T..8\.z..9\6...:\....;\c...<\)&..=\...>\>5..?\JU..@\.r..A\....B\9...C\....D\S...E\....F\\y..G\Y...H\%...I\....J\M...K\.a..L\.j..M\.n

C:\Users\user\AppData\Roaming\GamePall\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Roaming\GamePall\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	377856
Entropy (8bit):	6.602916265542373
Encrypted:	false
SSDEEP:
MD5:	8BC03B20348D4FEBE6AEDAA32AFBBF47
SHA1:	B1843C83808D9C8FBA32181CD3A033C66648C685
SHA-256:	CBEE7AC19C7DCCCA15581BD5C6AD037A35820DDFE7C64E50792292F3F2E391E6
SHA-512:	3F9EEC2C75D2A2684C5B278A47FB0E78B57F4F11591FAC4F61DE929F716BBAA8F7DF05E10390408AD6628538611541548C26869822372E9C38D2C9C43881651E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....`...`............................................... ............@A........................8,..h....:..(.......x........................>..........................D........p..............(<..`............................text....^.......`.................. ..`.rdata..L....p.......d..............@..@.data....4...p.......`..............@....00cfg...............\|..............@..@.tls.................~..............@....rsrc...x...........................@..@.reloc...>.......>..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6635008
Entropy (8bit):	6.832077162910607
Encrypted:	false
SSDEEP:
MD5:	63988D35D7AB96823B5403BE3C110F7F
SHA1:	8CC4D3F4D2F1A2285535706961A26D02595AF55C
SHA-256:	E03606B05EEAED4D567EA0412350721C0D566B3096B18C23BD0B3FCDE239E45A
SHA-512:	D5F5ACA00BE9E875FCD61531CC7F04F520FB12999E36E4FE06BEAAE491B47D2E9FE182015DB1CBFBB8E78CF679F2EB49E20ECDF1B16D1D42058D6F2D91BC3359
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!......L...........@.......................................e...........@A.........................].......^.d.....a.......................a.."...U]......................T].....X.L.............H.^.@.....].@....................text.....L.......L................. ..`.rdata...I....L..J....L.............@..@.data...X....._.......^.............@....00cfg........a.......a.............@..@.tls..........a.......a.............@....rsrc.........a.......a.............@..@.reloc..."....a..$....a.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176517632
Entropy (8bit):	7.025874989859836
Encrypted:	false
SSDEEP:
MD5:	F5259CC7721CA2BCC8AC97B76B1D3C7A
SHA1:	C2FC0C8396D8CD6764809A2A592972E2EBCA64BA
SHA-256:	3FE6A262EF01CB8FD4DC2D4373DE0F1F0A89EE51953452ED4557CB55F1DA9AB4
SHA-512:	2D01B1F2B24717EFF37965BBC32D167434A65F3DFFF74342D2E2FA8FBB0E97C3F61FDF673A13AD63031D630D9CE46A6F9F0C4F89EBD30C31F3EA55817B9D1331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.........N.......k....................................................@A........................#..........h....0J.(C....................L.\|.\.P................................?..............`.......LY..@....................text............................... ..`.rdata...%2..0...&2.................@..@.data...dr+..`.......>..............@....00cfg........I.......&.............@..@.rodata.@.....I.......&............. ..`.tls..........J.......&.............@...CPADinfo(.....J.......&.............@...malloc_h..... J.......&............. ..`.rsrc...(C...0J..D....&.............@..@.reloc..\|.\...L..0\..B).............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40258
Entropy (8bit):	4.547436244061504
Encrypted:	false
SSDEEP:
MD5:	310744A0E10BD9C2C6F50C525E4447F9
SHA1:	9BA62D6AC2CB8EFF46C9B21051677FC1DC66D718
SHA-256:	E9C55CFF925E26812139CDCAD6612E0D69E317CB7BB1435C9EB5113D338ACCE7
SHA-512:	6DF9E3F9AFD7CDEC750B006987E5AEC445E163DD0B9CF1A9EA53F78DB2EE5FD654E3B4F82BCA3E1F4BEDB189F5DFA51189C820905676AD048DBE2E0AD405BF5B
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 0 0 0 0 14390 `.......8z..:&..:...;...;...<&..<&..<...<...=...=...=...=...>...>...>...>...>...>...?f..?f..?...?...@B..@B..@...@...A$..A$..A...A...B"..B"..B...B...C...C...C...C...D...D...D...D...D...D...E...E...E...E...Fn..Fn..F...F...GZ..GZ..G...G...HJ..HJ..H...H...I$..I$..I...I...J...J...J...J...K ..K ..K...K...L...L...L...L...M...M...M...M...N...N...N\|..N\|..N...N...Od..Od..O...O...P`..P`..P...P...QP..QP..Q...Q...RT..RT..R...R...S@..S@..S...S...T...T...T...T...U...U...Un..Un..U...U...VP..VP..V...V...W,..W,..W...W...X...X...X...X...X...X...Y\..Y\..Y...Y...ZB..ZB..Z...Z...[,..[,..[...[...\...\...\...\...\...\...]b..]b..]...]...^N..^N..^...^..._6.._6.._..._...`$..`$..`...`...a...a...a...a...b...b...b...b...c...c...c...c...c...c...dj..dj..d...d...e^..e^..e...e...fV..fV..f...f...g8..g8..g...g...h..h..h...h...i"..i"..i...i...j...j...j...j...k...k...k...k...l...l...l...l...l...l...mh..mh..m...m...nN..nN..n...n...o2..o2..o...o...p...p...p.

C:\Users\user\AppData\Roaming\GamePall\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	470498
Entropy (8bit):	5.409080468053459
Encrypted:	false
SSDEEP:
MD5:	64F46DC20A140F2FA3D4677E7CD85DD1
SHA1:	5A4102E3E34C1360F833507A48E61DFD31707377
SHA-256:	BA5CA0A98E873799A20FD0DF39FDB55AAB140E3CC6021E0B597C04CCE534246D
SHA-512:	F7D789427316595764C99B00AF0EF1861204F74B33F9FAB0450F670CB56290C92BFB06EF7D1D3B3BF0B6ACDC6295E77F842C49579BD9973E3D5805920CDB2527
Malicious:	false
Reputation:	unknown
Preview:	........$$..e.>...h.F...i.N...j.Z...k.i...l.t...n.\|...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................&...........5.....<.....C.....D.....E.....J.....W.....f.....w.................x.................A.......................S.........................................%.....{.......................V.......................J.......................Y.......................e.......................a.......................l...................................O.....f.......................).....z.......................6.....u.......................Q.......................E.....w.................!.....I.....R.............................l.......................f.................+.............................f.......................D.......................<......................._.......................2.....~.................2.....v.................X...........$.....8.................P.....r...........6.....j.....}.................1.....?...................

C:\Users\user\AppData\Roaming\GamePall\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	763010
Entropy (8bit):	4.909167677028143
Encrypted:	false
SSDEEP:
MD5:	3B0D0F3EC195A0796A6E2FAB0C282BFB
SHA1:	6FCFCD102DE06A0095584A0186BD307AA49E49BD
SHA-256:	F9F620F599BC00E84A9826948C3DA985AC9ADB7A6FFB4C6E4FBEFEAF6A94CF85
SHA-512:	CA9217F22C52EF44E4F25142D1AD5DD9D16E4CCC3B6641609E1F4C2650944E35BA4CAB59CA5CD9EA6FEFD6BE1D3E8227FC0E3E6BDEDD14B059CA2C72D096D836
Malicious:	false
Reputation:	unknown
Preview:	........>${.e.r...h.z...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|...............................................F.....f.....'...........V...........Y.............................5.................F.................!.................d.....z...............................................C...........\.................z...........h...........3...........$.....C.................e.................i.................,.......................X.............................h.......................!.....\|...........$.............................1.....}.........................................Z.................\|...........'.....N...........F.................;.............................G.................v............ ....4 ..... ....X!.....!.....!....x"....."....Z#.....#....M$.....%.....%.....%.....&....+'.....'.....'.....(....D).....).....)....2....................+....",.....,

C:\Users\user\AppData\Roaming\GamePall\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	838413
Entropy (8bit):	4.920788245468804
Encrypted:	false
SSDEEP:
MD5:	C70B71B05A8CA5B8243C951B96D67453
SHA1:	DEED73A89F0B3EDAB8FF74117CC6B31CB4F426E8
SHA-256:	5E0D4BC0893A334B6FFF610F66E4A00920530D73EC3257EB9D37A96EBD555C13
SHA-512:	E000FD3592AC5FE700C4CE117868915C066AC66D5954A1DE4F5AFF0F4559C93F7DFF47623F1837CE827FFF94E91ECD89A974037BE9CCCC8E672E229A1E8115E9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.^...t.g...v.\|...w.....y.....z.....\|.....}.........................................................................-.....d.................n...........A...........u.......................O.......................D.................Y...........3.....J...........=.....g.....~.....&.................O.......................B.....!...........u...........5...........).....W.................3.....N.....U.....B...........!.........../.....Y........... .......................g...........).....I.................#.....A...........@.................6........... .....D...........I.................%.............................=.................?...................................G...................................).....t............ ..... ..... ..... ....o!.....!....6"....\"....."....S#.....#.....#.....$.....%....V&.....&....5'.....'.....(....J(.....(....X).....).....).........z..............t+.....,....{,.....,....--

C:\Users\user\AppData\Roaming\GamePall\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	869469
Entropy (8bit):	4.677916300869337
Encrypted:	false
SSDEEP:
MD5:	12A9400F521EC1D3975257B2061F5790
SHA1:	100EA691E0C53B240C72EAEC15C84A686E808067
SHA-256:	B7FD85B33B69D7B50F6C3FDC4D48070E8D853C255F2711EEDAA40D1BA835F993
SHA-512:	31EAA1CBF13BC711750B257C6B75813ACC8E4E04E9262815E399A88B96BA7B5BE64CE2450638B5521D5CB36750C64848944168C3234D2CE15A7E3E844A1E1667
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....L.....n...................................I...........Q...........q.......................T.................E.......................7.....~...........<.................:.....&...........F.................X...........$.................Z...........X...........m.................C.........................................{...........:.....a...................................8................._...........O.....}...................................$.....h.........................................2.............................3 ....e .....!.....!.....!.....".....".....#....W#.....#....{$....-%.....%.....%.....&....k'.....'....T(.....).....).....).....).....*....`+.....+.....+.....,....p-.....-....&....../...../.....0.....0.....1....o2.....2....73.....4.....4.....4....-5.....5....X6.....6.....6.....7.....8.....9

C:\Users\user\AppData\Roaming\GamePall\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1118348
Entropy (8bit):	4.2989199535081895
Encrypted:	false
SSDEEP:
MD5:	89A24AF99D5592AB8964B701F13E1706
SHA1:	2177122C6DCC20E1D07EF43AF5A112E8E5C6B95B
SHA-256:	5BDBBCD0D07B6AE3A7F96F07871EE541F4111D90D73FD6E112C5ABE040025C96
SHA-512:	60F6CD73BF35886EF54FA6200F86BCED78DD11F612C8071F63EB31108F109C166D45609879E8E5107024A025BAFCFCF1C80051B6D8FF650D92DCF17136384EB1
Malicious:	false
Reputation:	unknown
Preview:	........($..e.F...h.N...i._...j.k...k.z...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......#.....(.....0.....8.....=.....E.....L.....S.....Z.....[.....\.....a.............................=.....G...........?.....4...........................................................B.....}.....>...........k...........X...........].............................q.....W...................................W...........S...........e.............................I.....m.....e..........._.....(.................9...........q.................p...........5.....X.....8...........Q...........M...........I.....u.....-...........!.....G............ ..... ..... .....!....P".....".....".....#.....%.....%.....&.....'.....'....^(.....(....;).....).........6.....+.....+....1,....],....E-................-/...../....x0.....0.....0.....1.....2.....2.....3...."4.....4....x5.....5.....6....78....*9....]9.....:.....;....;<.....<.....=....?>.....>.....>.....?....y@.....@.... A....&B.....B

C:\Users\user\AppData\Roaming\GamePall\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537139
Entropy (8bit):	5.397688491907634
Encrypted:	false
SSDEEP:
MD5:	37B54705BD9620E69E7E9305CDFAC7AB
SHA1:	D9059289D5A4CAB287F1F877470605ED6BBDA2C8
SHA-256:	98B2B599C57675EFC1456B38B23CE5657B142E0547F89AB1530870652C8EB4BA
SHA-512:	42D667FEB59BB5FA619AC43DC94629ED1157CBE602643FB21378A2C524EF1F6E32098E7C62D3F3DE35D9FEDEF6607FE034908601AE3C49156CD0916E2514D2F9
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....I.....c.....\|................._...........[.....z...........O.................D...........(.....G.................B....._.................A.....T.................8.....I...........3.....u...........(.......................p.................,.......................1.................T.....o.............................v.......................b.......................@.......................@.......................O.......................<.............................`.......................P.........................................M.......................H......................._.........................................n.......................Q.......................[.............................1.................>.........................................6.............................\|...........".....>.

C:\Users\user\AppData\Roaming\GamePall\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	545011
Entropy (8bit):	5.844949195905198
Encrypted:	false
SSDEEP:
MD5:	65A2C2A73232AB1073E44E0FB6310A5F
SHA1:	F3158AA527538819C93F57E2C778198A94416C98
SHA-256:	E9A1610AFFCA9F69CD651C8D2EDD71B5A0F82CB3910A8A9D783F68E701DB5BB0
SHA-512:	20ED527F3BBBA2CECE03D7B251B19D6DCC9D345B5425291D8139FCDD5646EC34D585891160CC4BD96C668D18FFFFDD56F4D159880CFC0D538749F429F7F65512
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.&...i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................#.....$.....%.....'.....7.....I.....[.....p.............................\|.................%...........(.........................................3......................./.......................2.......................z...........I.....k...........R.......................v................./.......................z...........=.....W.................&.....=....................... .....o.......................^.......................r.......................m.......................b.......................z.................0...........%.....i.......................3.....G.......................(.......................1.................R................./.....J.....^...........A.....q.................`.................,...................................V.....w...........Z.......................O.....t.................b.......

C:\Users\user\AppData\Roaming\GamePall\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	496165
Entropy (8bit):	5.446061543230436
Encrypted:	false
SSDEEP:
MD5:	A44EC6AAA456A6129FD820CA75E968BE
SHA1:	9B5B17AFD57ADB8513D2DA9A72223E8A003975A5
SHA-256:	F01F9C3E4E6204425F2969F77BF6241D1111CE86CDD169BDF27E5D2D4B86C91A
SHA-512:	947DB81EA64009CC301CD2DCE06384202E56446F6D75E62390334B91D09B564CB0681E06BF7A945033BD6C28C2171346A91EE16693262C4E373A31B51AD42A9E
Malicious:	false
Reputation:	unknown
Preview:	........,$..e.N...h.V...i.g...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}."........../.....7.....?.....G.....N.....U.....\.....].....^.....`.....n.....~.........................................Q..................................q.................].......................P.....w.................8.....b.....p...........9.....h.................n.................7.......................^............................. .....p...................................q.......................X.......................1...............................................".............................{.......................Z.......................C.....p.....~...........y.................4.............................l.......................I.....f.....v...........^.................................................................F.......................B...................................O.....~...........J.....z.................$.....@.....M.................F.

C:\Users\user\AppData\Roaming\GamePall\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	534726
Entropy (8bit):	5.49306456316532
Encrypted:	false
SSDEEP:
MD5:	49CA708EBB7A4913C36F7461F094886B
SHA1:	13A6B5E8DC8B4DF7A976A0859684DC0AA70F1B12
SHA-256:	8AE7D6B77C51A4FE67459860ABDAE463F10766FAF2BA54F2BB85FD9E859D2324
SHA-512:	6908F96BFDF7499B33E76697AA96103E89ACB3E25EDBD6156B610564AF14D4ED474C547A760503490B6327A801478E223039836BEEF2B938AF76827A15C0F751
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.................................................................X.................E...................................^.....x...........n................./.......................Z...................................U.....w.............................h...........&.....7...........9.....w........... ................. ..........._.................D.......................U.......................h...................................a.....x...........f.........................................F.......................u...........).....;...........j.................A.......................;.......................9.......................t...........,.....`...........-.....K.....b...........G.....s.................}.................T...........,.....6...........S................./.......................K.......................t...........*.

C:\Users\user\AppData\Roaming\GamePall\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	950999
Entropy (8bit):	4.76377388695373
Encrypted:	false
SSDEEP:
MD5:	9CBC320E39CFF7C29F61BD367C0BF3BB
SHA1:	2AF07EFFF54A0CF916CF1C0A657F7B7ADF2029FF
SHA-256:	E8837DEFA908EB2FD8B4EB6344412C93403A4258F75EC63A69547EB06A8E53B3
SHA-512:	F7D84185F4520E7AAF3F3CACF38B53E9638BB7D5023FA244020EC8D141FFD5C10B198FF089824D69671FE8350F931B0BB19B6CAF14AF47B0838953367A146DD0
Malicious:	false
Reputation:	unknown
Preview:	........)$..e.H...h.P...i.X...j.b...k.q...l.\|...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................&...........6.....=.....D.....K.....L.....M.....O.....v.......................5...................................V.................h...........F.....i...........~...........{...........a...........'.................&.......................M.....U.....O............................./.....J.....1..........._...........{.....6................. .............................g.......................<.................J...........8.....t.....O.....).......................U............................................................ ..... .....!.....!.....".....#.....$.....$.....$.....%....\|&.....&.....'.....'....;(....t(.....(....M).....)....;....h....U+.....,.....,.....,.....-....8.....t...........f/....(0.....0.....0.....1....S2.....2.....3....64....Q5.....6....@6....A7....(8.....8.....8.....9.....:....o;.....;....[<....%=.....=.....=.....>.....?....6@

C:\Users\user\AppData\Roaming\GamePall\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	430665
Entropy (8bit):	5.517246002357965
Encrypted:	false
SSDEEP:
MD5:	0F1E2BC597771A8DB11D1D3AC59B84F3
SHA1:	C1F782C550AC733852C6BED9AD62AB79FC004049
SHA-256:	E4798E5FF84069C3BFD7D64734CCD9FF5C8A606315B44A714ACDCABDDAF3CA6E
SHA-512:	07E9B98357C880995576059AD4E91E0F145DC0F2FFF2DFDAD8649FA42EB46FA86F7F093503C41019EAD4550784E26C553D171518355FBBF995E38B1F6D7ABFF0
Malicious:	false
Reputation:	unknown
Preview:	.........$ .e.(...h.0...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................%.....,.....3.....4.....5.....:.....G.....V.....f.....w...........J.......................H.....y.................I.......................@.....o.......................?.....M............................._.......................B.......................8.............................[............................V.....a................l............................. .....^.............................A.....b.....n.................H.....[.......................+.....t.......................5.....y.......................:.....c.....n...........'.....d.....y.................).....?.............................G.............................].......................4.....O.....^.................6.....F.................#.....;.................V.....d...........$.....[.....x.................F.....U.............................k.............

C:\Users\user\AppData\Roaming\GamePall\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	434598
Entropy (8bit):	5.509004494756697
Encrypted:	false
SSDEEP:
MD5:	FEAB603B4C7520CCFA84D48B243B1EC0
SHA1:	E04138F1C2928D8EECE6037025B4DA2995F13CB4
SHA-256:	C5B8FBDBB26F390A921DCACC546715F5CC5021CD7C132FD77D8A1562758F21F4
SHA-512:	E6B3970A46D87BFD59E23743B624DA8116D0E1A9912D014557C38FD2664F513E56317AFA536DF52E7E703863FBD92136BE57EE759A2FFC2958AB028F6287E8B7
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.,...y.2...z.A...\|.G...}.Y.....a.....f.....n.....v.....~.................................................................G.......................\.......................Q.......................T......................./.....t.......................7.....^.....k.................".....9.................!.....9.............................i.......................7.......................!.............................K.....f.....u.............................Y.............................k.......................G.....t.......................7.....B.............................J.......................$.....~.......................^.............................=.....R.............................q.......................X.............................X.......................7.....o.................X.......................k.......................a.......................!.....C.....S.................,.

C:\Users\user\AppData\Roaming\GamePall\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	524728
Entropy (8bit):	5.377464936206393
Encrypted:	false
SSDEEP:
MD5:	32A59B6D9C8CA99FBD77CAA2F586509A
SHA1:	7E8356D940D4D4CC2E673460483656915AA59893
SHA-256:	AA4A5AA83DD5F8476867005844F54664DB1F5464A855EF47EC3A821DAF08E8F2
SHA-512:	860BA06228BBA31EEC7EB8BD437DDB6E93BABD0129033FB6EFF168F2FB01B54E2B93D2AB50A5D4F5D2FB7B04A5D0DD5541999D708CC2613B74AADD17B3E98735
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....\|.......................J...........>.....Y...........1.....v..........."...................................L.....g.................4.....G.................,.....=...........7.....}...........6...................................6.....I.................\.....s..........._.................Z...........2.....Y.......................:.......................".......................0.................R.....e...........).....g.....s.................P.....[.................4.....>.................L.....\...........O.................!.....v.................+.....x.................i.................:.................2.......................!.......................0.................I.....c...........x.............................B.....p...........V.......................G.....j.....}...........n.............

C:\Users\user\AppData\Roaming\GamePall\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	523181
Entropy (8bit):	5.356449408331279
Encrypted:	false
SSDEEP:
MD5:	3D1720FE1D801D54420438A54CBE1547
SHA1:	8B1B0735AE0E473858C59C54111697609831D65A
SHA-256:	AE32D66C0329104B9624BA0811FE79149D1680D28299440EC85835DBA41C7BD2
SHA-512:	C033BBB5261EC114DCB076EDB5E4B3293F37D60C813674A947F996606A6289204C04D2E4315356D92EEEB43FF41D534997DBEBBF960B17F2F24AA731AFE4B7E1
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.p...j.\|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.....\|.......................O...........G.....b...........D.................0........... .....:.................Y.....t.........../.....^.....n...........0.....X.....i...........c.................W...................................I.....Z................f.....{...........o.................g...........+.....P.................8.....N.................".....1......................@.................?.....R.................;.....G.................%.....0.............................y...................................D.....^.................@.....].................5.....T...........;.....`.....s...........h.................M.......................A.......................W.............................&.................)...................................A.....U................. .....3.................D.

C:\Users\user\AppData\Roaming\GamePall\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	475733
Entropy (8bit):	5.456553040437113
Encrypted:	false
SSDEEP:
MD5:	C00D66D3FD4FD9D777949E2F115F11FB
SHA1:	A8EAAD96CABCDFB7987AF56CB53FA5E16143EC48
SHA-256:	26C438935E3F666329EE8D1DABA66B39179BCF26EBAC902F9B957A784BDC9B4A
SHA-512:	E7E8C083B556DD05874AC669B58A4D1CD05D1E1B771EB4C32942869E387C6FA2B317B5F489138BD90135117DAEB051D96A7823B531DF0303BD4245A036F25A20
Malicious:	false
Reputation:	unknown
Preview:	........@$y.e.v...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................S...........J.....e...........4.....d.....w...........Y.......................u.......................m.......................\.......................[.........................................7.......................;.......................K.......................x...........;.....R.................9.....T................. .....,.............................w...........#......................./.....=.................'...../.................".....1.................$.....,.................O.....g.................4.....J.................,.....O.................4.....A.................=.....i.................&.....7.................#.....;.................?.....Z...........U.................C...................................@.....M...........................................

C:\Users\user\AppData\Roaming\GamePall\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	773397
Entropy (8bit):	5.04618630633187
Encrypted:	false
SSDEEP:
MD5:	C998140F7970B81117B073A87430A748
SHA1:	8A6662C3AABDAC68083A4D00862205689008110C
SHA-256:	182F18E4EFCA13CA59AFD1DF2A49B09733449D42526EE4700B11A9C5E6AAC357
SHA-512:	5A947A44F674F9556FDD44D2E4FF8CF0E0AAC4475FFA12480CA1BD07CFE7514961B7CACE6760189432B4B4BEB5EA5816701158EB3CB827A806F3063853C46D5E
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.#...s.4...t.=...v.R...w._...y.e...z.t...\|.z...}...............................................................................-.....T.....9.......................^...........u..........._.............................H.................a...........S.....f...................................?.................j..........._.............................'...........f.......................I.......................v.............................Q.....u...........}.................S...........).....@...........x.................m...........M.....d...........p.................H.................:...........`.................`...........l...............................................s...........C...........0.....P.......................;...........1 ....V ....q ....+!.....!....'"....I"....."....\|#.....#.....#.....$.....%.....&.....&....j'.....(....l(.....(....W).....)....M....p.....*....n+.....+.....+....d,.....-....P-....x-

C:\Users\user\AppData\Roaming\GamePall\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	483378
Entropy (8bit):	5.428549632880935
Encrypted:	false
SSDEEP:
MD5:	1CFD31A6B740D95E4D5D53432743EBF1
SHA1:	20CEEEA204150BD2F7AAE5866C09A3B0AE72D4C5
SHA-256:	F821E06B4BACD9E7660A2D6912A049591FFD56C6D2A0A29B914648589B17B615
SHA-512:	C483B7347F91BE8EE515DCF352A1D7502B9A159EDE35EACCEBAA763B93A625BCE2D0C7D598C2A6111092257D6DAC7A167102E956697210D4694B9812D70C8A94
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...\|.b...}.t.....\|.....................................................................................................^.....q...........7.....j.....}...........Z.......................~.......................s.......................D.....d.....t........... .....F.....`...........C.......................Q.....}.................S.......................T.........................................E.............................k......................./.....P.....\.................).....3.............................p.......................L.......................0.......................%.......................B.............................g.......................e.......................d.......................M.....d.....s...........*.....T.....f...........".....[.....u...........x.................I.......................Y.......................4.....v.......................S.....~.

C:\Users\user\AppData\Roaming\GamePall\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	546749
Entropy (8bit):	5.197094281578282
Encrypted:	false
SSDEEP:
MD5:	6EDA0CD3C7D513AAB9856EC504C7D16F
SHA1:	BA24C4B994E7866F2C012CCEC6C22DFC1A4FCFF6
SHA-256:	3CD2BC9E887663C5E093E0334BC60CF684655A815E3DE7AD9A34BAD5EBB858B1
SHA-512:	47000F5EA882CB9EDDCF4FB42ED229423EE55AA18B4A4353D7EF85ADFA7E1B0BBB33C2469887224D7146B3E33FB2296749CD053D68D7DAF26980BC710A27C63E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.@...h.H...i.^...j.j...k.y...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......!.....&...........6.....>.....E.....L.....S.....T.....U.....Z.....g.....\|.................K...........:.....X...........O.................Q...........>.....e...........Z.......................~.................%.......................h.................H...........^.................M.................!.................H.....b...........].................V...........B.....d...........#.....N.....k.................A.....N.................,.....;.................S.....i...........5.....k.....z...........=.....o.....}...........>.....o.....}...........@.....r...................................R.......................L.......................<.......................e.................U.................F.....`...........>.....q.........................................%.................4.................4.................J.....b.................B.....X...........N.......

C:\Users\user\AppData\Roaming\GamePall\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	568277
Entropy (8bit):	5.380723339968972
Encrypted:	false
SSDEEP:
MD5:	D185162DF4CAC9DCE7D70926099D1CF1
SHA1:	46594ADB3FC06A090675CA48FFA943E299874BBD
SHA-256:	E40C07183A32B75930242F166C5AAE28F4CD769BB2268391BEAA241814E7D45A
SHA-512:	987D9CC6AD5F2ED6A87537FDADF105F6EB31A97B11156E70814FE021047E5D8D08398F008812038DF3CCDCB6254BF5B744D9982FE04F79D407AC2F53BB046E25
Malicious:	false
Reputation:	unknown
Preview:	.........$..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}..................................... .....'.........../.....0.....2.....B.....P.....b.....q.................6.....X...........?.................'.................(.................W.................4.....`.....p...........D.........................................{...........(.....L...........*.....i.....{...........S.........................................}...........i.................N.......................H.....r.................N.......................f.......................}.......................x.......................e.......................d.................+.................&.......................8.....~.......................k.................0...........;.......................f.........................................d.................6...........4................."...................................R.....k.................G.....[...........G.......

C:\Users\user\AppData\Roaming\GamePall\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1103776
Entropy (8bit):	4.336526106451521
Encrypted:	false
SSDEEP:
MD5:	44F704DB17F0203FA5195DC4572C946C
SHA1:	205CBCC20ADCCCF40E80AA53272FBA8CD07389CA
SHA-256:	4B073F08F0C8C035974B5EC43AA500F8BDD50E6CFE91A2FB972A39E0F15ECEDD
SHA-512:	3CFD4501556845141EE9B461C831CA59779AD99F0E83E8D03433DE78D774378E87DE752DD9711C112A0C584259AD1DA6DC891D92F3F447F63A4D84263CD5BFCE
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|.......................&.....b....._.....0.....l....._..... ...............................................a.......................G.................r...........\.....\|....._...........z.......................V...........n.....B...................................7.....4...../.......................".......................4.....p...........P...........E.....m.......................................................................'...........}.......................C.................j .....!....u!.....!.....".....#....\$.....$....K%.....%....R&....{&.....'.....'.....'.....'.....(....b).....).....*....'+.....+....t,.....,.....-....9.....\|............/....W0.....0.....0.....1.....2....33....f3.....4.....5.....6.....6.....7.....8....<9.....9....\|:....H;.....;.....;.....<....s=.....=.....=.....?.....?.....@

C:\Users\user\AppData\Roaming\GamePall\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	681555
Entropy (8bit):	4.658620623200349
Encrypted:	false
SSDEEP:
MD5:	E75086A24ECAA25CD18D547AB041C65A
SHA1:	C88CE46E6321E4A21032308DFD72C272FB267DBD
SHA-256:	55BE8A5ED9FB9C129AC45B7FC99574B9907350AFD024BAA5D07525F43E995F6B
SHA-512:	01D7FDD90B8D0D3779B8442250E2AA767481B2E581F880BF9C3DCBB15FCE52E477B1881F3704FBCB3172DB77DB10241BCB24851BFE30066D1E9B66244B3C6877
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...q.a...r.m...s.~...t.....v.....w.....y.....z.....\|.....}.........................................................................+.....D.....].....z.....?...........~...........).............................O.................T...........#.....E...........:.......................w.................W................./...........F.................V...........5.....T...........K.................3.............................o...................................E.........../.....a.....t.............................z...........,.....?...........5.....v.................q.................5.......................r.................1...........X.................I.......................y.................$.................k...........).................!.......................#.................7.....P...........e.......................e.............................w...........W ..... ....$!....K!.....!....7"....g"....."....@#.....#....-$

C:\Users\user\AppData\Roaming\GamePall\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1167065
Entropy (8bit):	4.308980564019689
Encrypted:	false
SSDEEP:
MD5:	1FF8A0B82218A956D2701A5E4BFA84EF
SHA1:	56BB8218963E14ADCC435F2455891F3A0453D053
SHA-256:	62E7C3ABC317931723BE11ADD3712DD15EAAB0A35A4D8E7DB0B6347104EC5733
SHA-512:	3330D983401953AA5ED4856A8D10FFCBEEFC2A4E594CF850566A0AD38837BC1164870BB1270B6BBE5D7DD6FB1ECA29CDE85869A5C51808B901CDC282E04764E4
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....\|.....}...............................................................................?.....j.............................................../.....j.........................................N.....}.....P...........^...........F...........A.....d.....K...........N.............................L.....&...........V...........f...................................L.....~.................{.................A.................y..........}...........;........................................[.................,.....K...................................j ..... ..... .....!....J".....".....".....#.....$....T%.....%....@&.....&....8'....d'.....'.....(.....(.....(.....)....6..........*.....+.....,.....-....c-......................%/.....0.....0.....1.....1.....2....i3.....4....B4.....5.....6.....7.....7.....9.....9....S:.....:.....;.....<....F=.....=.....>....N?.....?.....@.....@.....A....LB

C:\Users\user\AppData\Roaming\GamePall\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	526575
Entropy (8bit):	5.518614920030561
Encrypted:	false
SSDEEP:
MD5:	0BD2F9847C151F9A6FC0D59A0074770C
SHA1:	EA5313A194E9D99489E9F1D7B4DFC0BC986C8E17
SHA-256:	5F2F1AA2E2EC78F375084A9C35275E84692EE68A1E87BBEF5A12A2C0FCF7F37A
SHA-512:	0032C0B41FDF769DAA1AF23C443D4195B127DF9EA8621174F1AABDBAFAE4954383095FA1EEAD14FC458188B8837BBE9AECA0D5338E4D47F10D976FBED8609496
Malicious:	false
Reputation:	unknown
Preview:	........F$s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...\|.D...}.V.....^.....c.....k.....s.....{.................................................................k...........Y.....z...........F.....~...................................e.......................y.......................m.......................l................. .................q................._.........................................A.............................4.......................j.......................D.....f.....w.................*.....:.................4.....I.................&.....5.................8.....M................. .....0.........................................S.....n.................0.....M.......................3....................... .................E.....v...........!.....F.....\...........).....[.....t...........U.................M...........(.....:...........".....`.................G.....v.................$.....B.....T...........0.....n.

C:\Users\user\AppData\Roaming\GamePall\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	566819
Entropy (8bit):	5.6387082185760935
Encrypted:	false
SSDEEP:
MD5:	4C27A1C79AB9A058C0A7DFFD22134AFD
SHA1:	5F0A1B34E808B91ADB1E431E462D9FCF82F4FFF2
SHA-256:	AD98C0A367B51EB217E69D66FA6A946946E85EC8452FC5A7AE0F179F35BE28C3
SHA-512:	0F066DB5905EB24B6CB4FBC7C81F017B43AFB7A6E975886644D871E979406B990509905D100653496EE2D20969A77434B702FF1EA5D348274AE54EA597A91D5E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................+.....A.....V.....j.................9.....W...........N.............................................".....X.....q...........K.....r.................Y.................?................."...........I.................7.......................k...........'.....7...........:................./.................:.................Z.....w...........O.....v.................f.................5.................(...........2.....u...................................M.................0...........6.....x...................................m.................)................. .....I.................O.....g...........c.................O.......................E.......................r...........'.....H...........v.............................l...........7.........................................5...........& ....q

C:\Users\user\AppData\Roaming\GamePall\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	466959
Entropy (8bit):	5.379636778781472
Encrypted:	false
SSDEEP:
MD5:	1466C484179769A2263542E943742E59
SHA1:	18E45A08661FD6D34BADE01CDB1E1D5184BA2B67
SHA-256:	C331293D16B16B08DEF73BE73437845D58C593941320C547A377DB423749AEBB
SHA-512:	ABC54D5CAAA663578F064E43CC0465BEB97EFC46991936708EBF3FCD64BD007E47072AB4834A5361B21F064BB0F6527E247BC2C2F0DFB8336F50C2FF3E15A59C
Malicious:	false
Reputation:	unknown
Preview:	........ $..e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....V.....c.....s.................k................. .....l.......................l.................-.......................0.............................R.....s.................I.....x.................T.......................@.....j.....w.................L.....Y.................Z.....m...........H.......................%.....@.....Q.............................c.......................<.......................#.....t.......................L.....x.................%.....R.....^.................>.....K.................5.....G.............................J.......................".....h.......................L.....}.................#.....=.....K.................+.....:.................2.....K...........C.......................u.................,.....\|.......................C.....b.....r...........1.....h.

C:\Users\user\AppData\Roaming\GamePall\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	522800
Entropy (8bit):	5.284113957149261
Encrypted:	false
SSDEEP:
MD5:	7767A70358D0AE6D408FF979DF9B2CD4
SHA1:	9C57A5B068DC12AAF1591778DEF5D3696377EDAB
SHA-256:	672908E77E9EACA793654C8E630442099DE3BE772FD3230A9C4045CAFBCC0B1E
SHA-512:	913AA8C49D04CD84706D08A88453D1ED36FDE6A00F7C1DF63DECEA99316A8A234924457C0C50937329B3979E437B1C2D7796E63ADF209505E212FDCEAE3BFDB5
Malicious:	false
Reputation:	unknown
Preview:	........-$..e.P...h.X...i.i...j.u...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.....u.......................E...........3.....O.................V.....g..........._.................o...........#.....L.............................k.......................n.................2..................................w.................5.......................R...................................c................./.....[.....y.................=.....K.............................x..............................................`.......................4.............................^.........................................B.............................F.....\.....r........... .....L.....a...........=.......................b.......................8.....c.....v...........[.................c...........S.....j...........d.................[.................).....v.......................X.............

C:\Users\user\AppData\Roaming\GamePall\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	634636
Entropy (8bit):	5.718480148171718
Encrypted:	false
SSDEEP:
MD5:	4A4AF69546DCF65F2D722A574E221BEA
SHA1:	EE51613F111CF5B06F5605B629952EFFE0350870
SHA-256:	7AD195AF107F2A394BAB527C3E84E08F3B7748076F23459F084CF0E05DD29655
SHA-512:	0E93F6B22F7C9176EFC9D49901BFBD281FA5AC3632780DFA76CE597CADD8C1CF570A9163A86BC320BBFBD354F48288DBEC5E36A6088999B00A3561D302A96D03
Malicious:	false
Reputation:	unknown
Preview:	........n#K.e.....h.....i.....j.....k.....l.....m.....o.%...p.2...q.8...v.D...w.Q...y.W...z.f...\|.l...}.~...............................................................................................6.....W...........}.................l........... .....8...........c.......................B.................W.......................x...................................7.....V...........e.................=.......................].......................{...........#.....2...........y.................`...................................<.....W...........j.................y...........e...................................h...........(.....:...........%.....a.....p...........{.................}...........m..................................._...................................Z.....x.............................o...................................:.....U................d.....z....."................?...........X.................`.................@.................g............ ..... ..... .....

C:\Users\user\AppData\Roaming\GamePall\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1256908
Entropy (8bit):	4.247594585839553
Encrypted:	false
SSDEEP:
MD5:	6A41A5AB03A22BDAEC7985B9A75EC11A
SHA1:	6BB02DF557BD6522E02FE026C0243BEB9332B2E5
SHA-256:	E22873652AC7D9D18E47DAE838D121B5644EDA4C67F7B0BC110733BF7E931FEA
SHA-512:	BCA661D802D29463A847AC77EB8D5DFA41C31455E7314049CA26555957DCA3BE33701C074F7ED26D2C375A0A9C5F8A93461007B8D74F5ED3BD27C02E5DB170A5
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}.................................................................W...........".....V.....W...................................n...........b............................._.......................<.....)...........s.......................).............................1.....7...................................[......................................................................u...........f...........K.....^........................ ..... .....!..../"....i"....=#.....#....r$.....$....I%.....%....l&.....&....p'....((.....(.....(.....)....N...............,.....-.....-................./.....0....W0.....0....z1.....1.....1.....2....Y3.....3.....4....@5.....6.....6.....7.....8.....8.....9....V9.....:....R;.....;....1<.....=....B>.....?....]?.....@....DB....BC....wC.....D.....E.....F....$G....\H....AI.....I....4J.....K.....K.....L....PL.....M....lN.....O

C:\Users\user\AppData\Roaming\GamePall\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532715
Entropy (8bit):	6.0824169765918725
Encrypted:	false
SSDEEP:
MD5:	5FD9942F57FFC499481947DB0C3FDFA7
SHA1:	4D60AB21305902877467FF6151C1B7AB12553AAE
SHA-256:	09E279860E20E9E559945940E29446CAD4273D05C5F3F15D0BAD664A1D5749F2
SHA-512:	97953E580588C07769F1BD0002E2DF648FFCE5B246D2359E4475EDCFA1CD6E7286BAF168A115D7A65686B2151C313B6FD0C271E40B1F9DD4132F2F39904FE8D4
Malicious:	false
Reputation:	unknown
Preview:	........O#j.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.#...z.2...\|.8...}.J.....R.....W....._.....j.....r.................................................................].................5.................O.....b...........F.......................p.................'.......................,.......................;.......................L.......................e.......................Y.......................X...................................Q.....h.................>.....U................. .....0.........................................-.....I.................A.....Q.................L....._.................K.....[.................J.....Z...........O.......................Z.....{.................U.....}.................`.................%.......................J.............................h.......................\.................+.......................m.........................................'.............................x.........................

C:\Users\user\AppData\Roaming\GamePall\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	573015
Entropy (8bit):	5.63016577624216
Encrypted:	false
SSDEEP:
MD5:	8745B87D09D9ECC1112C60F5DD934034
SHA1:	2F411E4EEF0E656CAC0C755FECE1AD2531CB689E
SHA-256:	D546C994C81510122E7B2359DA50F694E1F0CA4081830404E16187A5CF4D4E0D
SHA-512:	27B658C153A01AABB9595C5B1059567E535EDFC8F8187B89316D2C85694DE32696D209CFDD2A32C4826DFB1E50AC692937156563EE190E68DB358C40F9AAE15F
Malicious:	false
Reputation:	unknown
Preview:	........+$..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.....l.....y.................4...........".....=...........S.................M...........'.....A...........8.....p...................................A...................................B.....g...........z.................R...................................;.....K...........c.................T...........2.....P...........2.....Y.....t...........W.........................................E...................................D.....S...........Q.........................................S.............................B.................&.......................t...........1.....Y...........K.................+.........................................'...........N.................A.................,...........q.................d...........&.....F...........x.................(.......................H ..... .....!

C:\Users\user\AppData\Roaming\GamePall\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	570683
Entropy (8bit):	5.624052036286866
Encrypted:	false
SSDEEP:
MD5:	E16B0B814074ACBD3A72AF677AC7BE84
SHA1:	10744490B3E40BEB939B3FDCA411075A85A34794
SHA-256:	46B5C09AA744AF0F660C79B0CDBDE8C8DBDD40A0BA1A23AAF28D37ECC4211DC5
SHA-512:	70EA9DFAC667C0992AE0E95815A47EB8E779BAAE1215E733AFE84EEE26D3BA754AD838C12E9AEE3114D7BBE11CD21B31C550F5CAFE6C5E838B69E54C6174EF18
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}...................................................................................Z.................G.................%...........Z.................F.................6.................Q.....\...........Q.........................................\|.....#.....t...................................W.................0...........T.................B...........8.....Y...........$.....J.....`...........-.....V.....h...........;.....b.....v.............................G.......................r.........../.....>...........'.....Z.....k...........c.................@...........3.....K.................).....>...........=.....t.................c.................(.................2.......................8...........<.....q.........................................:.................8...................................N.....^...........0.....K.....m............ .....

C:\Users\user\AppData\Roaming\GamePall\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1307271
Entropy (8bit):	4.279854356980692
Encrypted:	false
SSDEEP:
MD5:	309E068B4E15157486D095301370B234
SHA1:	D962CDAF9361767045A928966F4323EAD22D9B37
SHA-256:	4F2C19B7E94B695C5C5CAB95DEE6E49AE53C3337C351B5C665BCB6BA4E6AE909
SHA-512:	6B1333946C7950D97D2DF29D063DB39A0EC5C0EEAA1ECA40743E4A6A0E4C972D897D3FF2BA837B53E31B8003F2C5C4BACCB7A4AB4B50C6CB47DF39AD7B8E05E7
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.............................^.............................j.......................\|............ ..... .....!.....!....".....#.....#....V$.....$....n%.....&.....&.....&.....'....n(.....(.....)..........*....W+.....+....c,....+-.....-.....-...........0.....0.....1.....1.....2....!3....Y3.....4.....4.....5....T5....06.....6.....7.....7.....9.....9.....:.....;.....;.....<.....=....Z=....\|>....s?.....@....T@.....A....UB.....C....SC.....D.....E....yF.....F.....G.....H.....I.....I....-K....(L.....L.....M.....N.....N....eO.....O.....P.....Q.....R

C:\Users\user\AppData\Roaming\GamePall\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1075591
Entropy (8bit):	4.313573412022857
Encrypted:	false
SSDEEP:
MD5:	69C36C23D6D9841F4362FF3A0F86CFDF
SHA1:	C4C1F632EB8373107AEEBD6C26ECF036AEDA2B6B
SHA-256:	6A794C2B08F8B046BE771DF33719536BDAF2371E3825D49A0E556958B781832D
SHA-512:	8C1329BDB371677BC0A9D727A38591EDF32025BAE1E7EFE402D01C6A8BB5F647D827C59A18F40455D5C9C0482798525C98C3F1C8AC568AA886D7C1ED07D1580E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................@.....b.................%.....]...........W.................J.............................:.....@.....=...................................&.................&.....F.....P.......................h...........o...............................................c...................................R..........._.................i...............................................J.................. .....!.....!....(".....#.....#....O$....{$....B%.....&....c&.....&....F'.....(...._(.....(....R).........y.....*.....+.....-.....-................./...../...../.....0....61....l1.....1....Z2.... 3.....3.....3.....4.....5.....6.....6.....7.....8.....9....E9....u:....n;.....;....@<.....=....O>.....?....5?.....@.....A.....B.....B....MD....WE.....E....eF....nG....LH.....H.....H.....I.....J.....J.....K....5L....)M.....M

C:\Users\user\AppData\Roaming\GamePall\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	489457
Entropy (8bit):	5.250540323172458
Encrypted:	false
SSDEEP:
MD5:	A1253E64F8910162B15B56883798E3C0
SHA1:	68D402D94D2145704DC3760914BF616CC71FC65D
SHA-256:	E033BFAD6CD73EA7B001DFAF44B7102E3BBE2A1C418F005C149E4FB2565DB19F
SHA-512:	ABD63713093049ECC8E24FD8145EAE065340058A3C38758A59EE8796FBED7E6CFBC54982D650889F1CEB54797060C7DDA12EEE2A963B14C5E907A110C2057DBE
Malicious:	false
Reputation:	unknown
Preview:	........T$e.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...\|.W...}.i.....q.....v.....~........................................................................................._.....{...........:.....n.....~...........\.................#.......................=.......................1.......................3.......................Y.................*.....z.......................W.......................E.......................b.........../.....A.............................N.......................$.....x.......................r.......................z.......................p.......................^.......................Q.......................r.................!.....s.......................S.....w.................6....._.....p.................T.....w.......................#.......................$.................2.....K...........B.......................s.................,.............................P.....r.................0.....].

C:\Users\user\AppData\Roaming\GamePall\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	476208
Entropy (8bit):	5.4272499712806965
Encrypted:	false
SSDEEP:
MD5:	622ED80836E0EF3F949ED8A379CBE6DF
SHA1:	9A94CD80E747B88582470EF49B7337B9E5DE6C28
SHA-256:	560B2F09C1B6E6BB7E6A5A5F9BF85A88BD2ACA054B7D4A5955D9C91B6D7CA67C
SHA-512:	950627E74180E1451BB35AE4A7416AC14D42D67BBBB59DC51D7B69E4CEB61715F8F9B0EB9D7F35FCEFD4D43FABE5CE2103F1AF3709CAE6733C25AC19E6339A83
Malicious:	false
Reputation:	unknown
Preview:	........2$..e.Z...h.b...i.y...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.....}.......................N...........A.....V.................X.....k...........z.................K.......................L.......................:.......................;.......................g................./...........<.........................................R.................1...........Q.......................\.....u.................1.....V.....f.................9.....I.................H.....\.................J.....Z...........".....T.....d.................@.....P.................<.....J...........4.....y.................B.....h.....{...........&.....E.....^.................-.....?...........,.....k.................V.....\|.................b.......................i.................&.......................s...........9.....b...........*.....V.....i.................".....0.................).

C:\Users\user\AppData\Roaming\GamePall\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	491139
Entropy (8bit):	5.362822162782947
Encrypted:	false
SSDEEP:
MD5:	C8378A81039DB6943F97286CC8C629F1
SHA1:	758D9AB331C394709F097361612C6D44BDE4E8FE
SHA-256:	318FB294CE025BDA7636B062CA7B6A1FB1E30C485D01856159CB5DB928782818
SHA-512:	6687FFE4DE0D5A2314743EB3134096292724163D4E0332D2F47922B4807B0CDE7C20E2D57D2662E403D801BC7A20BC247F5D0EDD787AB650E5766B49AF7D3C63
Malicious:	false
Reputation:	unknown
Preview:	.........$..e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....<.....H.....X.....i.....{.............................X.......................\|...........4.....J.................M.....d.................8.....G.......................).................8.....Y...........1.....h.................F.....{.................U.........................................\.................4.............................Y.......................-.....~.......................}.......................v.......................V.......................5.....a.....n...........*.....^.....m...........I.......................X.......................>....._.....v...........,.....T.....f...........8.....o.................=.....[.....o...........3.....e.....v...........H.....................................................E.....j...........5.....f.....{.................B.....R.................B.

C:\Users\user\AppData\Roaming\GamePall\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	550453
Entropy (8bit):	5.757462673735937
Encrypted:	false
SSDEEP:
MD5:	80C5893068C1D6CE9AEF23525ECAD83C
SHA1:	A2A7ADEE70503771483A2500786BF0D707B3DF6B
SHA-256:	0069648995532EFD5E8D01CC6F7DD75BD6D072E86C3AE06791088A1A9B6DACC4
SHA-512:	3D1C41A851E1CF7247539B196AD7D8EE909B4F47C3CFB5BA5166D82CDA1C38049B81A109C23FA6D887490E42EE587CC2A6BD96A3EA890267C089AC74710C755F
Malicious:	false
Reputation:	unknown
Preview:	........6$..e.b...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.............................X...........S.....o...........=.....w...................................i...............................................z.................$.................1.....W...........M.................*.......................@.......................l...........0.....L...........].................9.....v.......................E.....h.....x.................,.....:.................<.....P.................>.....P.................6.....F.......................-.........................................e.....}.................4.....K.......................;.................+.....@.................a.................+.....I.....`.................9.....U...........2.....}...................................w...........'.....R.................9.....J.............................v.............

C:\Users\user\AppData\Roaming\GamePall\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	516256
Entropy (8bit):	5.426294949123783
Encrypted:	false
SSDEEP:
MD5:	3BA426E91C34E1C33F13912974835F7D
SHA1:	467A1B05BAD23252A08EE22E6B9EBB4404F6A0F0
SHA-256:	CB66D88D3B3938FE1E42C50ECB85CEDB0D57E0F0AB2FA2A5FC0E4CDEA640E2B7
SHA-512:	824A4301DC4D935FF34CE88FAA0354440FC1A3A8E79B0F4B0B2DCC8F12542ECEF65828FB930EDF5B35BF16863296BBAE39E9306962B4D3CFA9F6495AC05BDEF4
Malicious:	false
Reputation:	unknown
Preview:	........9$..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.$...\|.*...}.<.....D.....I.....Q.....Y.....a.....h.....o.....v.....w.....x.....}.............................d...........L.....h.........../.....h.....x.............................w.................(.....y.......................^...................................:.....j..........._.................:......................._...................................K.....d...........p.................5.............................q.......................n.......................w.......................p.......................O.....}.................).....W.....a.................V.....g...........b................. .....j.......................;.....a.................=.....U...........N.................2.....W.....p...........8.....p.................S.................@.................0...........1.....{.................X.......................0.....V.....k...........C...................

C:\Users\user\AppData\Roaming\GamePall\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	518861
Entropy (8bit):	5.4029194034596575
Encrypted:	false
SSDEEP:
MD5:	4D7D724BE592BD0280ED28388EAA8D43
SHA1:	8E3C46B77639EB480A90AD27383FBB14C4176960
SHA-256:	4724D82866C0A693C2B02D1FFA67D880B59CDB0D3334317B34EC0C91C3D3E2A2
SHA-512:	D05388F66C50E039F7D3393515740F6B2593F9C0EF8651F9CDE910C5FF06656E0D22FDB066B22665289EE495837EA16CC085ECB3F85B0F6FB498AECDAA19ADF7
Malicious:	false
Reputation:	unknown
Preview:	........I$p.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...\|.J...}.\.....d.....i.....q.....y.......................................................................u...........Z.....u...........@.................).................$.................S.....w.................D.....T.................(.....:...........(.....j.................x.................H.......................g...................................9.....N...........D.......................p.......................^.......................a.......................q.......................r.......................U.............................[.....e.................P.....a...........?.......................O.....y.............................?.................0.....J...........#.....p.................9.....c.....u...........#.....Y.....n.........../.....}...............................................G.....k...........N.......................B.....g.....\|...........J.......

C:\Users\user\AppData\Roaming\GamePall\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537125
Entropy (8bit):	5.4566742297332596
Encrypted:	false
SSDEEP:
MD5:	4F1C0A8632218F6FEF6BAB0917BEB84F
SHA1:	05E497C8525CB1ADE6A0DAEFE09370EC45176E35
SHA-256:	9C19835F237B1427000D72C93703311CFCBEFF6C2B709474B16DB93E629BC928
SHA-512:	A7CDF94F79CD888BB81FD167F6B09BF1BEF2C749218869E5A12A0A3B2C2506D1A63F64B63D8E48EA49375636041C639082563BF9D526FE44003FC5A5E8D50E9D
Malicious:	false
Reputation:	unknown
Preview:	........0$..e.V...h.^...i.o...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....u.......................3.................+.................%.....9...........@.................1.......................Q.......................4.......................C...................................>.....b...........@.......................d.........................................p...........@.....n.................+.....H.............................h.......................M.......................J.......................7.............................].......................E.....t...................................?.............................W.....w.................\.................).......................f.......................W.........................................'...........$.....y...................................f.......................j.......................l...........+.

C:\Users\user\AppData\Roaming\GamePall\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	878725
Entropy (8bit):	4.848685093578222
Encrypted:	false
SSDEEP:
MD5:	3A3D0D865A78399306924D3ED058274E
SHA1:	AA1A42DB6021666B2297A65094D29978792CE29B
SHA-256:	EAB4C32FEBE084CC7A3A272CDA008B69D6617ED6D042376B0316BE185B9E66FE
SHA-512:	ACA8C87D0B2BB35A325726F7774F8A0232B99C8EFE0F948AB68210958E23B95E9D9026A9430D96FC2D5CEBA94815F4217896EF877C9A6E1D0E56F73533FB1D12
Malicious:	false
Reputation:	unknown
Preview:	.........#/.e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................9.....V.....n...........V.......................g...........i...........l.....).................g...........,.....f.......................@.................6.....M......................./....."...........l..........._...........D.....y..... .................&.......................5.....9.....3.............................B.................r.................D...................................=.....b.........................................E.....\...........Y.................'...................................D.....n...........j.................9.......................a...........i...........v...........t...........a........................ ....,!....l!.....!....j"....."....R#....\|#....O$.....%.....%.....%.....&....x'.....(....Q(.....(....z).....).....)....]..........+....$+.....+.....,.....-

C:\Users\user\AppData\Roaming\GamePall\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	553886
Entropy (8bit):	5.812150703289796
Encrypted:	false
SSDEEP:
MD5:	A9656846F66A36BB399B65F7B702B47D
SHA1:	4B2D6B391C7C2B376534C0AF9AA6779755B4B74E
SHA-256:	02B65F48375911C821786D91698E31D908A4C0F5F4F1460DE29980A71124480E
SHA-512:	7E23CAA89FF80BF799AC5353CEAF344CBED0393F23D15FCBE8DC24EE55757F417CEA3BFC30889FD2CB41951F9FA5629C2E64B46DD9617D4A85EFEF0A255246F6
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.\|...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.%...}.7.....?.....D.....L.....T.....\.....c.....j.....q.....r.....s.....u.............................h...............................................[.........../.....I.................S.....j...........9.....h.....{...........4.....].....q...........J.................?.............................%.....`.....y...........\................./.............................%.....v.................G.....g.....\|...........=.....c.....u...........6.....].....o...........O.........................................".......................3.......................R.............................-.....x.................0.....K....._.................0.....E.................G.....W...........T.................).....w.................-.......................M.............................O.................J.........................................'.........................................E.

C:\Users\user\AppData\Roaming\GamePall\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532410
Entropy (8bit):	5.486224954097277
Encrypted:	false
SSDEEP:
MD5:	BE49BB186EF62F55E27FF6B5FD5933F4
SHA1:	84CFD05C52A09B4E6FA62ADCAF71585538CF688E
SHA-256:	833F2E1B13381AA874E90B747931945B1637E53F2396A7409CCDA0A19CBE7A84
SHA-512:	1808631559D3C28589D3F5A4B95554CEBC342DE3D71B05DDC213F34851BF802967BFFAC3D7668C487265EE245D1E26EFCE5D317EDBFBBEEB4BC2C9F122980585
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.6...i.G...j.Q...k.`...l.k...n.s...o.x...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....P.....^.....n...................................y.................&...........2.....}.................h.......................g.......................Z.......................v.................O...................................3.....I.................T.....h...........b.................S...........$.....J.......................(.............................n.......................z...........$.....8.................2.....C...........).....j.................;.....i.....\|...........?.....q.................[.......................g.......................L.....j.................G.......................~.................I.......................B.......................b.............................^.............................o.........................................j.......................x.......

C:\Users\user\AppData\Roaming\GamePall\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	818089
Entropy (8bit):	4.779985663253385
Encrypted:	false
SSDEEP:
MD5:	AFA2DFBA3BD71FE0307BFFB647CDCD98
SHA1:	CD7A5C54246E891981AEEEAA88D39EC9E3F2C594
SHA-256:	1375353837629A20102C69BF62701EE5401BED84D3DC4845BED5EE43E4D322CF
SHA-512:	CE8BBBDDC33CB6B8DF4AEE127A8987E6D8C1D0761AC5BD25D685310BAA2D377F239BDF06F2C04B54295CF8FD440697A69A040644D5A7C0395C4F71A0252B8E87
Malicious:	false
Reputation:	unknown
Preview:	........=$\|.e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~.........................................).................W...........O...........\...........z.....E...................................3...........b.................a.................5.......................1.....1...........v...........\|...........{...........`...........Y.....~.....d...................................S........... .......................{...........(.....K...........H.................c...........d...........3.................)...........B.................D.................(...........W.......................E.................~...........'.....O...........^.................~ .....!....]!....z!....J"....."....=#.....#....0$.....$.....$.....%.....%....P&.....&.....&.....'....1(.....(.....(.....).....*....5+....S+....A,.....,....Z-.....-....^...........=/....^/...../....Y0.....0.....0.....1....'2.....2

C:\Users\user\AppData\Roaming\GamePall\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	479512
Entropy (8bit):	5.541069475898216
Encrypted:	false
SSDEEP:
MD5:	09592A0D35100CD9707C278C9FFC7618
SHA1:	B23EEF11D7521721A7D6742202209E4FE0539566
SHA-256:	9C080A2F6D4EDF0E2E94F78550B9DB59ADF5B1B9166DE2BAE496E6ABB6733304
SHA-512:	E0760B3F227A3E7EAEB4816B8E02BEE51C62730D24403724D66B36BCCBC0BDCD56DF9EAB28B073AB727EE12C8856A858E52A9803E1A1C9164FCD3CF2F716D8AF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................#.....5.....I.....]...........b.................).......................e...........2.....K.................T.....p...........&.....U.....e...........%.....V.....f...........J.........................................O.......................Y..................................._.....u.............................n.......................J.......................'...............................................(.............................z.......................j.......................h.......................\|.................$.....w.......................M.....k.......................?.....Q...........).....f.................J.....i.................;.....c.....x...........1.....l...................................q.................?.................;.....N.............................p.............

C:\Users\user\AppData\Roaming\GamePall\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	504856
Entropy (8bit):	5.34516819438501
Encrypted:	false
SSDEEP:
MD5:	9E038A0D222055FED6F1883992DCA5A8
SHA1:	8FA17648492D7F093F89E8E98BF29C3725E3B4B5
SHA-256:	DDCA575D659545D80E715EB4176BBBBFBD3F75E24B223537B53740B0DCB282BD
SHA-512:	FB70F97E08191DFEB18E8F1A09A3AB61687E326265B1349AB2EFF5055F57E177A496BF0EA3592B61C71FE1F73C9143CA1495B05226F36EB481024827CAE6DCC4
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....m.............................?.................$.................2.....D...........7.......................P.......................A.....l.....{...........&.....U.....c...........0.....d..................................._.......................m.......................n.............................*.......................J.....r.......................>.....G.........................................A.....O.................4.....F.................G.....R.................).....6.................).....2.................\.....u...........(.....T.....p...........2.....c.................D.......................l.................B.............................j.................+.......................j...........?.....S...........5.....x...................................P.......................r...........%.

C:\Users\user\AppData\Roaming\GamePall\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1298313
Entropy (8bit):	4.058495187693592
Encrypted:	false
SSDEEP:
MD5:	36104CB0D5E26E0BBB313E529C14F4B4
SHA1:	69A509DEE8419DA719DCF6DE78BFE0A6737508C5
SHA-256:	DC28C869A143424F71EDCFDB08B56DA31C2EC96E9D608535FFA7DC0B0842B7D8
SHA-512:	D46ED1AA19EB298BC4C3D61EFC28D80753D6B551F01808E6158A0869FAAE8755DF61D4B4BAFF1310DD09FCFC385ABA67E1AA7D61BBE399DF7BB2D483EBE0FEFF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.(...h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....=.....k.................:...........5...........$.....v...........`...........(...........Z.................%.............................O...........j.....L.........................................m...........u...................................;.....c...........7.................................................................8 ..... ....m!....I".....".....".....#.....$.....%....9%....d&....n'.....(....L(....C)....4..........*.....+.....,....3-....a-....Z.....J/...../...../.....0.....1....Z2.....2.....3....:5.....6....Z6....U7....=8.....8.....8.....9.....:.....:....F;.....<.....=.....=.....>....E?....S@.....@....[A....3B.....B....IC.....C.....D.....E....[F.....F....+H....>I.....J....pJ....\L....FN.....O.....O....DQ....QR.....S....{S.....T.....V.....V....'W....+X.....Y.....Y.....Y.....[....9\.....\

C:\Users\user\AppData\Roaming\GamePall\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1199612
Entropy (8bit):	4.314031920337284
Encrypted:	false
SSDEEP:
MD5:	98714389748A98ECC536CD2F17859BDF
SHA1:	07761AA31588F30C2CED4A1E31FE99DDC43A5E8D
SHA-256:	8A81B1A5457407E49D6372677938E7A2D28DFCA69F555FEDC8A2C9C09C333A65
SHA-512:	38CC4F064BD874EEC9DBFAB4C2A83A487FBCD89CEFB40BE4213C42231BC48AF9255341C9D325EE059BC50EE533898C5FA22CD3B3927A8E045049DEF3C5DFB2C6
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t. ...v.5...w.B...y.H...z.W...\|.]...}.o.....w.....\|.......................................................................X...........J...........\|...............................................f.........................................~.............................Y.............................A.............................d.....X.........../.....k.....b...........5...............................................'.......................L.....u ....:!.....!.....!.....".....#....$....k$.....%.....&....6'.....'.....(.....)........._*.....+....P,.....,.....-....'...........m/...../.....0.....1...."2....f2.....3.....4....R5.....5.....6....G7.....7.....7.....8....I9.....9.....9....{:....0;.....;....)<.....=.....>.....?.....?.....@....bA.....A.....B....JC....(D.....D.....D....DF.....F.....G.....G.....I....@K....qL.....L....4N....EO.....O....pP.....Q.....R....?S.....S.....T....^U.....U.....V....`W....[X.....Y

C:\Users\user\AppData\Roaming\GamePall\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1008989
Entropy (8bit):	4.356501290091745
Encrypted:	false
SSDEEP:
MD5:	56F29DE3465795E781A52FCF736BBE08
SHA1:	EAA406E5ED938468760A29D18C8C3F16CF142472
SHA-256:	529C561747BF8B6206BE4F8BCF287A1D15E1B14A33113242DDAD5E035CA37BE6
SHA-512:	519B5B3CC7032B2AF856456EEC25019B3A6A7F2A6DB7A0318CF87C41E08C6F6BFA73E239939B0DA16972C1D357FF06177765D875E19742D23E99A95FD4AC5416
Malicious:	false
Reputation:	unknown
Preview:	........i#P.e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}.....................................................................................'.....{.......................^...........e...........f.................s...........I...........]...........P...........r.................{...........D.....]...........;...........$.................,.....}.....K...........v...........e...........r...........m.....................................................E.......................P.......................:.......................B.......................b.......................s.......................X.......................S..................!.....".....".....".....#....0$....\|$.....$....j%.....%....5&....l&.....'....z'.....'....!(....A).....)...............+.....,....H,....x,....M-.....-....6.....l.....k/...../....o0.....0.....1.....2....>3...._3.....4.....5....c6.....6.....7....n8.....8.....9.....9....f:.....:.....:.....;.....<....D=

C:\Users\user\AppData\Roaming\GamePall\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	515329
Entropy (8bit):	5.616482888977033
Encrypted:	false
SSDEEP:
MD5:	46CA9EE922C3C175DE466066F40B29CE
SHA1:	5563E236A15CD9CC44AE859165DF1E4E722936C7
SHA-256:	BD8B1441FD2057F0B61512CC0AA23DFD2619560CF886B4D453FA7472E7153A3F
SHA-512:	45AA2D6896568751C2F986ABD281EA07CB731880DF8F28F2F0AEFD95736F41B1E005D8DFB6F0AEF0CED6CEF94154D34FD0DA2CB7F0B0C66D9C085F5C47F32605
Malicious:	false
Reputation:	unknown
Preview:	........c$V.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...\|.\|...}...........................................................................................)...........L.................+.......................e........... .....;.................7.....J.......................)......................................... .....B...........5.....x.................Z.......................Q.....{.................w.................Q.................!.......................'.......................&....................... ................."...../.................5.....F.................9.....F.................2.....>.................7.....D...........I.......................v.......................i.......................P.......................q.................-.....z.......................m.................,.............................*.................B................."...........(.....n.................N.....~.................l.......

C:\Users\user\AppData\Roaming\GamePall\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	876131
Entropy (8bit):	4.88404350774067
Encrypted:	false
SSDEEP:
MD5:	1365ABDD1EFB44720EA3975E4A472530
SHA1:	8421FC4905C592EB1269C5D524AA46866D617D3C
SHA-256:	29AB0F7EE69FB7A1E1E54DD2A3746D2CFEAAA71AE5971EE30AA8E2E0F6556FA5
SHA-512:	2E806A9BEA864E689BBD1D78B800DFDBC6E4109320F9A4790E52010BFDEC20C7644655A6FE3BABDE0B84D9580208CB78EF1FA0DB3476F8676C17A13D130296C7
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.'...s.8...t.A...v.V...w.c...y.i...z.x...\|.~...}.....................................................................................1.....s.....W.......................r...........x...........m.....!.......................<.............................n...........,.................-...........\|.............................=.....y.....+...........%.....K...................................w.............................N...................................r.................O...........N.................^...........\...............................................h...............................................R.....m.....f.....6.............................W.....y...........O.....x...........K...........j...........z .....!.....!.....".....".....#....R#.....#....&$.....$.....$.....%.....%....s&.....&.... '.....(.....(....~).....).....*....Q+.....+.....,.....,....Z-.....-.....-....[............/....4/.....0.....0....$1

C:\Users\user\AppData\Roaming\GamePall\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	765853
Entropy (8bit):	5.17061834928747
Encrypted:	false
SSDEEP:
MD5:	3FED15E64BEAFBA75DE61B08A45AE106
SHA1:	E24953271D8C0254AD011D3A65B2C2FA57903681
SHA-256:	B6E250C3F4FBAC3AF5FB8BB1C61CACAD8685D7F2A97063DE23BC22E91B7F2E27
SHA-512:	3948D080135AFEB240815D43F7B5B8D407BA2830FF701D9B8343F2A72E610827EDAAB643444CDCEB86812ADFC9FB3FBA3AAD6DB7488843C2A04E92A3E63FE40D
Malicious:	false
Reputation:	unknown
Preview:	........1$..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.....\|.............................n.....................................................).....^.......................<...........G.................J.................9...........E.................~...........{...........\...........L.....k.......................,.................9.....e.....C.......................>...................................8.....Z...........C.................;.................-...........L.................N.................1...........-.....y.........................................s............................p........... .......................i...........).....J.......................L...........M ..... ..... ....Y!.....!....4"....Z"....,#.....#....&$....W$....'%.....%....^&.....&....f'.....(.....(.....(.....)....3..............]+.....+.....,....F,.....,....z-.....-

C:\Users\user\AppData\Roaming\GamePall\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	609259
Entropy (8bit):	5.796202390024141
Encrypted:	false
SSDEEP:
MD5:	CD741C24AF7597E0DC11069D3AC324E0
SHA1:	2A883DFBCF48D5093D70D4B77BBFFFA521287334
SHA-256:	13E982DC4B2B1AEE093E96BA27E02258C2B815CBB062006A4396BB3A3E6A84B1
SHA-512:	6D27998E25B57FF0CE08C3590B69031038CBA390E68333A83514022B2C56B689AF8AD9715302824027864B5320852E9AB77D74E3B8A90DC66DF59F48CEB528C9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r....s.;...t.D...v.Y...w.f...y.l...z.{...\|.....}...........................................................................................;.......................-...........A.................[...........O.....u...........v.................6.......................+.......................}...........G.....y.....9...........K.....y.............................z...........?.....V...................................T.................X.......................r...................................9.....J...........H.......................}.................'.......................<.......................O.............................Z................._..................................)........... .....V.....v.......................j...........N.................3...................................O.....v................./.....C.......................@...........) ....^ ....w ..... ....J!....}!.....!..../".....".....#....8#

C:\Users\user\AppData\Roaming\GamePall\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	441207
Entropy (8bit):	6.685712707138377
Encrypted:	false
SSDEEP:
MD5:	99E6ACFB46923C4F8B29058E9EE6166B
SHA1:	AF06C42E5F3578ADBC4F0BD7262DC6775FDD351F
SHA-256:	9D8498875263B19552A982D1850F2F942FF44AF4E323BC5A3A67C34413994D95
SHA-512:	4FDF5186FC2FC68210C2BE91F5B821F0979CA67D6C9B8915C14E7A20D3CE2548EB2660D5F9F398CF6C585A5C0725FA34FD3670F416F7C8A4F009C729BCF02988
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.T...h.\...i.d...j.g...k.v...l.}...m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...............................(.....-.....5.....<.....C.....E.....J.....S....._.....q.................v.................1......................./.......................:.......................>.............................c.......................D.....j................._.......................n.......................T.....}.................@.....o.................V.......................5.....O.....i................."...........x.......................U.......................].......................=.......................".....s.......................L.....u.................g.......................W.....w.................3.....X.....o...........&.....J.....\.................=.....].............................y.......................y...................................N.....`...........,.....d.....y...........).....O.....^.............................\|.......................x.

C:\Users\user\AppData\Roaming\GamePall\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	439630
Entropy (8bit):	6.6906570508767995
Encrypted:	false
SSDEEP:
MD5:	BB7C995F257B9125457381BB01856D72
SHA1:	21C55FF5CBC4F223C23D5A2FBCC9E051DB78A44C
SHA-256:	F2299E03E99B0E9A9CACE3B1C72E6C8C5FE089487CA1C82F2AAF4273B62E37A2
SHA-512:	5247C5DA6F00DF6241500524DDB162041A03649FA0AFCC11AD40E820814958768A2E11CE34E1250FDBF42B2459F8C06B00AE7442B537F0731A62C6724FC8D890
Malicious:	false
Reputation:	unknown
Preview:	.........#,.e.....h.....i.)...j.-...k.<...l.G...n.O...o.T...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....\|.....}...................................................................%.....4.....C...........3.....q.................+.....T.....`........... .....R.....d.................M.....b.................3.....?.............................g.......................[.......................S.......................;.......................*.......................@.......................F.............................D.....d.....p.................2.....A.............................q.......................T.......................<.............................i.......................f.......................A.....[.....o.................!.............................u.......................^.............................h.......................P.........................................H.......................Z.......................$.....e.....z.................1.....X.....j...........#.

C:\Users\user\AppData\Roaming\GamePall\log4net.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.778490068583466
Encrypted:	false
SSDEEP:
MD5:	7EA1429E71D83A1CCAA0942C4D7F1C41
SHA1:	4CE6ACF4D735354B98F416B3D94D89AF0611E563
SHA-256:	EDEC54DA1901E649588E8CB52B001AB2AEC76ED0430824457A904FCC0ABD4299
SHA-512:	91C90845A12A377B617140B67639CFA71A0648300336D5EDD422AFC362E65C6CCD3A4FF4936D4262B0EAF7BAE2B9624BCD3C7EEC79F7E7CA18ABE1EC62C4C869
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.X...........!.....,..........~K... ...`....... ..............................H.....@.................................$K..W....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................`K......H...........<x...............-..P .......................................i.)V.#c....e../.`...V....j>....?.LbrzKV.x.}...........[.f)..dD`..66.61[.z....W^....>F..r...#. ..g...T...P....Ss)ii.a.v.(0.....(1...o2...s....}.......0..7........{....-%~....r...p.{....r9..p(3...(.....(.......(4.............//........{...."..}......{........0..4..........%...(5....-.~....r?..p(....+...}.......,..(6............')........{......{...."..}.......{...."..}....*.0..........

C:\Users\user\AppData\Roaming\GamePall\log4net.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1547797
Entropy (8bit):	4.370092880615517
Encrypted:	false
SSDEEP:
MD5:	32AB4E0A9A82245EE3B474EF811F558F
SHA1:	9F2C4C9EEB5720D765F2321ACD0FF9F8DD11E6A4
SHA-256:	9BBF4D15F8FB11F7D2C032BD920D2A33B2C2CB8EF62E7E023049AF6132F5D6C1
SHA-512:	A0574A170F69F9926C32BAF6119A16A381FEC9E881B304082859EE7CFF463570C78984EE14369C59CDB19E532B3ABF193D02B462F1B40D07214B6244150CD63F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>log4net</name>.. </assembly>.. <members>.. <member name="T:log4net.Appender.AdoNetAppender">.. <summary>.. Appender that logs to a database... </summary>.. <remarks>.. <para>.. <see cref="T:log4net.Appender.AdoNetAppender"/> appends logging events to a table within a.. database. The appender can be configured to specify the connection .. string by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionString"/> property. .. The connection type (provider) can be specified by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionType"/>.. property. For more information on database connection strings for.. your specific database see <a href="http://www.connectionstrings.com/">http://www.connectionstrings.com/</a>... </para>.. <para>.. Record

C:\Users\user\AppData\Roaming\GamePall\natives_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	342741
Entropy (8bit):	5.496697631795104
Encrypted:	false
SSDEEP:
MD5:	A58DB728B50E6B82CBDCAA0DB61D36B1
SHA1:	7CD76526CB29A0FF5350A2B52D48D1886360458B
SHA-256:	BA2F2AC6AE9BC67399728F25772A0EB3E840695395CC747ADF4B2F8B5D6D9A46
SHA-512:	0DB9AFBDADA44364521D89BAB6055458125F4F3C8C1B09048EAFA4055A194231CCFFD82FCDADA9360AB2B19F472B893330EBFCB027391E7A0C2B1100FC51E673
Malicious:	false
Reputation:	unknown
Preview:	..mirrors....(function(a,b){."use strict";.var c=a.Array;.var d=a.isNaN;.var e=a.JSON.stringify;.var f;.var g;.var h=b.ImportNow("promise_state_symbol");.var i=b.ImportNow("promise_result_symbol");.var j;.var k;.b.Import(function(l){.f=l.MapEntries;.g=l.MapIteratorNext;.j=l.SetIteratorNext;.k=l.SetValues;.});.var m={.UNDEFINED_TYPE:'undefined',.NULL_TYPE:'null',.BOOLEAN_TYPE:'boolean',.NUMBER_TYPE:'number',.STRING_TYPE:'string',.SYMBOL_TYPE:'symbol',.OBJECT_TYPE:'object',.FUNCTION_TYPE:'function',.REGEXP_TYPE:'regexp',.ERROR_TYPE:'error',.PROPERTY_TYPE:'property',.INTERNAL_PROPERTY_TYPE:'internalProperty',.FRAME_TYPE:'frame',.SCRIPT_TYPE:'script',.CONTEXT_TYPE:'context',.SCOPE_TYPE:'scope',.PROMISE_TYPE:'promise',.MAP_TYPE:'map',.SET_TYPE:'set',.ITERATOR_TYPE:'iterator',.GENERATOR_TYPE:'generator',.}.var n=0;.var o=-1;.var p=[];.var q=true;.function MirrorCacheIsEmpty(){.return n==0&&p.length==0;.}.function ToggleMirrorCache(r){.q=r;.ClearMirrorCache();.}.function ClearMirrorCache(r){.

C:\Users\user\AppData\Roaming\GamePall\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	8226870
Entropy (8bit):	7.996842728494533
Encrypted:	true
SSDEEP:
MD5:	F7EC58AEA756F3FD8A055AC582103A78
SHA1:	086B63691F5E5375A537E99E062345F56512A22C
SHA-256:	517418184EA974C33FFE67B03732D19B1234DCB9E5C1C2E9E94ED41B3BC1D064
SHA-512:	C620C6E16BBCEE9BC607E6CA75D602C756276AC69E5F3761D82DE7728164133656A71A69043EB1A86CE3051FDE4327A47EFD41D1FF47C8385699CA67C423AD7B
Malicious:	false
Reputation:	unknown
Preview:	............f.6:..{..D..\|..G..~. K.....]....._....=.....c...........9.....B.............................F.....K/.....2....54....r5.....6.....?.....@....jB.....C....hD.....E.....H....nj.....k.....r....@~...."..........W.....................;..../;'...2;P...7;....8;....C;....D;U...E;....F;....G;A,..H;.;..I;gK..J;.Z..K;.h..L;.}..M;y...N;{...O;z...P;....Q;8...R;....S;....T;C'..U;.=..V;.W..W;.m..X;....Y;....Z;D...[;....\;....];.....<.....<x....<.....<-....<\....<.....<.....<.....<.....<*(...< /...<+3...<.3..I=.3..J=.7..K=.9..R= >..S=.G..T=}V..[=;w..\=.x..]=.}..^=R..._=....`=....a=....b=....c=....e=:...f=.....=....=.....=....=`....=p....=.....=.....=.....=.....=.....=K....=.....=t....=.....=.....=.....=\....=Z....=.....=T....=[....=x....=.....=.....=D....=.....=.....=.....=l....=F....=.'...=j)...>.+...>l,...>_0...>.2...>.6...>.8..N>.\..O>~^..P>._..Q>%d..R>.k..S>.l..T>Tn..U>.p..b>.u..c>/y..d>.\|..B@....C@....D@o...E@....F@W...L@Z...M@(...N@...O@....D.....D ....D ....D;....D.....D....D..

C:\Users\user\AppData\Roaming\GamePall\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	276319
Entropy (8bit):	4.242318669799302
Encrypted:	false
SSDEEP:
MD5:	8234983533FA47D2A1D7710FF8274299
SHA1:	E4C5793B6FE6A6C6C9D8E3921B3BC341AE3448D8
SHA-256:	F95553D8066144CBB8A05EED1735C94A4B97A2E44E49F624C2302990A13017C9
SHA-512:	1E7E201B0FF9AFA7821B5FFD0A36548A49CD4DBBABA5858E13DA35058670A5053723DD3544B2FD85C619F2B8FC9E5DB48DF977BB293E7BA7DE6F22CC8DAB28CA
Malicious:	false
Reputation:	unknown
Preview:	.........X./j1N.11.8.172.9.......................................................@...y...........@..`....`....`....`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\start.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.8731406795131327
Encrypted:	false
SSDEEP:
MD5:	2C66F3C2190A84FAFD4449DAF6440EAC
SHA1:	7B9E4C94329FE26C34E63AB8336227FD5EB553E9
SHA-256:	58EB97E30289A3FCAE270DBCC01258A862936350CB0EF781AE76D6A9444C0155
SHA-512:	62713209575426CE503605C6F451E9DFB025BE0295F0A453614862CE390F5987F0E16BAE6B37B4B1A7330A7CB5AA31249F8CF58DE37B8B701C16881E4E4E61C1
Malicious:	false
Reputation:	unknown
Preview:	start GamePall.exe OuWe5kl

C:\Users\user\AppData\Roaming\GamePall\swiftshader\Xilium.CefGlue.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	MSVC program database ver 7.00, 512*4023 bytes
Category:	dropped
Size (bytes):	2059776
Entropy (8bit):	4.067542396670122
Encrypted:	false
SSDEEP:
MD5:	70F9EAEA8A2A604E59F72EDE66F83AB4
SHA1:	0AB9EA1BFFDFF471EC22AB289C7FBC5E0CDF48BF
SHA-256:	38A07BA75CC2BBDF715CA87D380A4E5A0DCFAF9C30C5ECD30F6107871D51825B
SHA-512:	47DE4DAD93385A4907FADE307040FE026ED66989C0C9915AFC96CB2BC93DE5E106DC1274E4AD2382021C758C60FEDE06D68998CF3591E23E2951778CE09D6D4C
Malicious:	false
Reputation:	unknown
Preview:	Microsoft C/C++ MSF 7.00...DS................J..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	6.54104466243173
Encrypted:	false
SSDEEP:
MD5:	7A53AD3E5D2E65C982450E7B7453DE8A
SHA1:	99F27E54F1F61207C02110CAC476405557A8AD54
SHA-256:	24FDDD6A367792A9D86D9060FC9AA459B5FB0F67804CB7D139A100D86BBDAFF8
SHA-512:	2B5E5DB46FDC787CB46CDAEBFFC01586E248FBB864677B27AF03CDC33E956DEF51B3F836597E7092C4175CF605C44728C6F96B74BB2C9870E9715D4AF4C531A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.........T............................................................@A....................................P....p...........................3..4.......................8........G...............................................text............................... ..`.rdata..............................@..@.data....4..........................@....00cfg.......@......................@..@.tls.........P......................@....voltbl......`...........................rsrc........p......................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2445312
Entropy (8bit):	6.750207745422387
Encrypted:	false
SSDEEP:
MD5:	334C3157E63A34B22CCE25A44A04835F
SHA1:	C6B05BD55BE9FED3B0C5077C5649E2A41C10DC08
SHA-256:	3E307570B574469EC8BCF1CE6D5291DF8D627CA3812F05AACFEBBD3F00B17F89
SHA-512:	11F538ADD05515861891892EBB90163B6540B72FEB380D64B4A0AA56C6415E3B71374557BF50D0B936712B1006F2B94D59BEBFBF18CBF93BB883D9055CAAEEE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.....4 .................................................p*...........@A..........................#.. ....$.d....P)......................`).......#.......................#......."...............$.P............................text.../2 ......4 ................. ..`.rdata..\....P ......8 .............@..@.data...L....@$...... $.............@....00cfg....... )......>$.............@..@.tls.........0)......@$.............@....voltbl.M....@)......B$..................rsrc........P)......D$.............@..@.reloc.......`)......H$.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	631017
Entropy (8bit):	5.144793130466209
Encrypted:	false
SSDEEP:
MD5:	0794DF29DF8DFC3ECE5C443F864F5AEB
SHA1:	BFD4A9A34BEB9751BC4203FB9A9172F1F05E5B16
SHA-256:	3EE2237E9B14871165B051CCF892C8375E45B5F12841E02F4B9D37F5D5A03283
SHA-512:	0D34E36F7455B977F086F04840FBA679284A619A7164A56B5C7FC2ADCB23A231B67A62101540EB07CF5C8192790266B08D2CC232D291621C331FE77C1F5E52C0
Malicious:	false
Reputation:	unknown
Preview:	..........d..<..11.8.172.9......................................................@...]!...S..y...-[..........`....`....`T...`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4400640
Entropy (8bit):	6.667314807988382
Encrypted:	false
SSDEEP:
MD5:	7F913E31D00082338F073EF60D67B335
SHA1:	AC831B45F2A32E23BA9046044508E47E04CDA3A4
SHA-256:	B60E9818C4EA9396D0D2D2A4AC79C7DC40D0DFF6BB8BC734D0AB14ADC30FBF30
SHA-512:	E1AC79C775CF9137283CD2C1AE1A45EC597E0351CDB9C11D483E2E1F8B00CC2BBC5807A50DED13A3A5E76F06C1A565EFF1233F4EC727B0C5F7AA3BEAEA906750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....$5.........P.-......................................PD...........@A........................8=?.~....\?.P.... B......................0B.X.....?.....................H.?......@5.............._?..............................text...T#5......$5................. ..`.rdata...a...@5..b...(5.............@..@.data...@N....?..x....?.............@....00cfg........B.......A.............@..@.tls....5.....B.......A.............@....rsrc........ B.......A.............@..@.reloc..X....0B.......A.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	6.78646032943732
Encrypted:	false
SSDEEP:
MD5:	A031EB19C61942A26EF74500AD4B42DF
SHA1:	FDC6EA473234F153639E963E8EFB8D028DA1BE20
SHA-256:	207706A3A3FAA8500F88CB034B26413074EFC67221A07C5F70558F3C40985A91
SHA-512:	80F843E47FC2B41B17EF6EA1BB2BB04119B2417311599EC52120D9F9DF316B4D7B1DAF97EE5CDF2AE78CDB9475E5C65255A7F2AB2A9231804F6A82C83303FD19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....\|..........@.....................................................@A...........................<!..$...P....p..............................l..............................................P................................text....z.......\|.................. ..`.rdata..tr.......t..................@..@.data....7..........................@....00cfg.......P......................@..@.tls.........`......................@....rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.566524833521835
Encrypted:	false
SSDEEP:
MD5:	6D7FD214164C858BBCF4AA050C114E8C
SHA1:	B8868DA6BB9A79EE7C9901A9BFAC580D5BAFCC96
SHA-256:	3F58FB22BD1A1159C351D125BEE122A16BB97BABB5FCA67FDBD9AAAED3B302E6
SHA-512:	0F8F2523C3A616AC7C72A1239B7E353F6A684FF75DA79D1CAF9B98A47FF6FE06329165825704C67C04E92073BA2C17D0FF339C57731DDF0F1489C2E97D1D0A14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^..._...^..._q..^..._..^..._..^..._..^..._..^k.._...^..._...^...^...^k.._...^k.._...^n..^...^k.._...^Rich...^........................PE..L...Ua.X.........."!.........(......c........0............................................@.................................x...<....@.......................P..T"......8...............................@............0..0............................text............................... ..`.rdata..`....0....... ..............@..@.data...............................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..T"...P...$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\etvjrtf

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	41369
Entropy (8bit):	6.598692343310211
Encrypted:	false
SSDEEP:
MD5:	C280B435AE8E9BCF43B221DF43E9FC65
SHA1:	5185A39475DE9E0B98F1FABA04A9E3BF9E3D5D76
SHA-256:	FA39D4DBBF0828F381CF30ADFB6B5F3C207E86D22ECCBFCC4D4ECD90573E4B6B
SHA-512:	1AB923C51AF946EA21FEF2056618B4180AE9933EE9BEFE100D61E6039CFC8A959C9E8ECCCF0EDBB6D23C545F8F81336C5555EB8694BB0C89B600A8AA2F7DD878
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Reputation:	unknown
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L..../\|f...............H............@2............@..................................................................................................................................................................................................text............................... ...................................................................................................o..).I....C....o_..ri.#.U..>..%..8..iv..BQ,.$....kl.%J.....\|.P....6.F...t.c;.f."......0.....h.X%]...T$.r.....3..{K...].jk?..~.E..CS.W..je<.r5;......P3.6~.{.......TSz.\.t..K~...y........).-Y..m...... ....<6..]ps....'#.=xnAL.q...2k.I../0.k..........\|...n..6;.y..m.......p..HIh......c.PL...e@.S.i}eaYHv.. {.o6.eB..CBX$.]..w17.X._.....+& /W.=..,.....M.l.XX.....c`.~t..........sl:haOV6.?.`.....<.z..PS..._.X.<.t.u....OV..\|$....t.u........4$.....u.t........t

C:\Users\user\AppData\Roaming\etvjrtf:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.598692343310211
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe
File size:	41'369 bytes
MD5:	c280b435ae8e9bcf43b221df43e9fc65
SHA1:	5185a39475de9e0b98f1faba04a9e3bf9e3d5d76
SHA256:	fa39d4dbbf0828f381cf30adfb6b5f3c207e86d22eccbfcc4d4ecd90573e4b6b
SHA512:	1ab923c51af946ea21fef2056618b4180ae9933ee9befe100d61e6039cfc8a959c9e8ecccf0edbb6d23c545f8f81336c5555eb8694bb0c89b600a8aa2f7dd878
SSDEEP:	768:Z/8mWE+vcY96DhR8ZSDc28hO3c3VgDeoVZnE:2a+0Y96DhR8658533s
TLSH:	F003E0910630D86FFAAD143214CFC72AE333A6F2260B176545751AE62446EE6E17373D
File Content Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L..../\|f...............H............@2............@........................................................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x403240
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x667C2F99 [Wed Jun 26 15:11:21 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:

Entrypoint Preview

Instruction
call 00007FB1ACB29605h
jne 00007FB1ACB29606h
je 00007FB1ACB29604h
push 0000005Bh
jmp 00007FB1ACB2960Ch
add al, 81h
jmp 00007FB1ACB29647h
xor al, byte ptr [eax]
add bl, ch
add eax, 04F5EB02h
add dh, byte ptr [eax+ecx+75h]
push es
int3
mov esi, 07B12E31h
push 00000030h
jne 00007FB1ACB29607h
je 00007FB1ACB29605h
push FFFFFF9Fh
add esp, 04h
mov edx, dword ptr [esp-04h]
jmp 00007FB1ACB29608h
add byte ptr [ecx], ch
shr bl, 00000005h
and bl, ch
stc
add byte ptr [eax], ah
jmp 00007FB1ACB29607h
les edx, edi
and bh, dh
and ah, byte ptr [ebx+eax+02h]
je 00007FB1ACB29609h
jne 00007FB1ACB29607h
cmpsd
add al, 27h
xor eax, dword ptr [ebp+00A4B0FFh]
add byte ptr [eax], al
jne 00007FB1ACB29607h
je 00007FB1ACB29605h
xor byte ptr [esi-17h], ah
pop ecx
jmp 00007FB1ACB29608h
cmc
and bh, dh
and dl, byte ptr [eax+06F980A0h]
jl 00007FB1ACB29672h
jmp 00007FB1ACB2960Ch
xor byte ptr [esi-48h], cl
sbb dword ptr [eax+5Eh], edx
jmp 00007FB1ACB29607h
out dx, al
and bl, ch
clc
stosd
jmp 00007FB1ACB29608h
cdq
and bh, dh
and cl, byte ptr [eax+48B60F88h]
add ch, bl
add eax, F7208C8Ch
and al, byte ptr [ebx+10EB01C1h]
xchg eax, ebx
inc esi
sti
mov eax, dword ptr [ecx+51h]
mov eax, dword ptr [esp]
add esp, 04h
jmp 00007FB1ACB29607h
jmp 00007FB19BA681B9h
jmp 00007FB1ACB29617h
cmpsb
cmpsd
shl byte ptr [ecx], 1
mov ah, 7Bh
push 000031F1h
mov ecx, dword ptr [esp]
add esp, 04h
jmp 00007FB1ACB29607h
xor ebx, dword ptr [eax]
jmp 00007FB1ACB295F1h
inc edi
jmp 00007FB1ACB29603h
dec esi

Data Directories

Name	Virtual Address	Virtual Size
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9180	0x9200	7d99401ab2526312d8e220cfa00a4fea	False	0.7697185359589042	data	7.062241098302679	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Target ID:	0
Start time:	19:31:50
Start date:	02/07/2024
Path:	C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe"
Imagebase:	0x400000
File size:	41'369 bytes
MD5 hash:	C280B435AE8E9BCF43B221DF43E9FC65
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1691624070.00000000004E1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1691528939.00000000001E0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:31:56
Start date:	02/07/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	19:32:15
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\etvjrtf
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\etvjrtf
Imagebase:	0x400000
File size:	41'369 bytes
MD5 hash:	C280B435AE8E9BCF43B221DF43E9FC65
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1924153562.00000000020A1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000003.00000002.1923776407.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:32:27
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Local\Temp\DBD3.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DBD3.exe
Imagebase:	0x620000
File size:	6'642'176 bytes
MD5 hash:	BD2EAC64CBDED877608468D86786594A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2076723236.00000000016A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2037792556.000000000169D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2024545560.000000000169D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2022920516.000000000169D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:32:35
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Local\Temp\FD47.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FD47.exe
Imagebase:	0x400000
File size:	293'869 bytes
MD5 hash:	60172CA946DE57C3529E9F05CC502870
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:32:41
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Local\Temp\1B6E.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1B6E.exe
Imagebase:	0xa20000
File size:	578'048 bytes
MD5 hash:	DA4B6F39FC024D2383D4BFE7F67F1EE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000009.00000002.2833845596.000000000160D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:33:55
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Local\Temp\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\setup.exe"
Imagebase:	0x400000
File size:	107'232'830 bytes
MD5 hash:	FF2293FBFF53F4BD2BFF91780FABFD60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	19:34:25
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Imagebase:	0x3b0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:34:30
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3300 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Imagebase:	0x9b0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	19:34:30
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3972 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0x450000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:34:30
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3996 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0xc70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:34:30
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171165647 --mojo-platform-channel-handle=4028 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0xd70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	19:34:30
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Mobile Safari/537.36" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719958699492342 --launch-time-ticks=5171215235 --mojo-platform-channel-handle=4164 --field-trial-handle=3304,i,1949751332316853400,13227287206754683143,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0x800000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	19:34:30
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc50000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	19:34:31
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xb30000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	19:34:31
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x1e0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	19:34:32
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xf80000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	19:34:34
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xff0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	19:34:34
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x30000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	19:34:34
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x4d0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	19:34:35
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xe90000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	19:34:35
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xa20000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	19:34:36
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x3b0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	19:34:36
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x60000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	19:34:36
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x9d0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	19:34:37
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x710000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	19:34:38
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x690000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	19:34:38
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xcd0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	19:34:38
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc40000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	19:34:39
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x9a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	19:34:39
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc90000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	19:34:39
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xb30000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	19:34:40
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	19:34:40
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x1c0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	19:34:40
Start date:	02/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xcf0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exePID: 7260, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	74.3%
Total number of Nodes:	70
Total number of Limit Nodes:	1

Executed Functions

Function 00401496 Relevance: 10.7, APIs: 7, Instructions: 247
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction ID: 8e4940cc2d5d294876689a6a874cb0cc3c399929e81e9dec1e5d288c8cd9e9dd
Opcode Fuzzy Hash: 5edb7204c22a8cfb94061bf161a88c3eca98da374ec15d8cd8ba2bf42dcd3747
Instruction Fuzzy Hash: F481B375500244BBEB209F91CC44FAB7BB8FF85704F10412AF952BA2F1E7749901CB69

Function 00401538 Relevance: 10.7, APIs: 7, Instructions: 207
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction ID: 71a4d0092025beca94809e07d65936591d52f1bb8effc294688e3fcd05e54c36
Opcode Fuzzy Hash: 4af5c640631db37ac51d1c1afd1ab74928840835cbc445bb96c3204467379d38
Instruction Fuzzy Hash: E0615171900204FBEB209F95CC89FAF7BB8FF85700F10412AF912BA2E5D6759905DB65

Function 004014DE Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction ID: 6a824664258ffec6fdf95c516407446232c8a84219ad61b9fd4b8efeb52f3576
Opcode Fuzzy Hash: c3f6308678fe624b1287adcb7156a2cf5c07ee8b7810a15753646c5694e98bc6
Instruction Fuzzy Hash: 9B615C75900245BFEB219F91CC88FEBBBB8FF85710F10016AF951BA2A5E7749901CB24

Function 00401543 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction ID: 1fc6fb52bb36dddf8f971a96ecfe927bdbae9887f6286775c14151e9c1d92244
Opcode Fuzzy Hash: f4faf4f0efc4cc5c307795d20c298965336779ff7452863f8b2b81be2522acaa
Instruction Fuzzy Hash: 13512B71900245BBEB209F91CC88FAF7BB8EF85B00F14416AF912BA2E5D6749945CB64

Function 00401565 Relevance: 10.7, APIs: 7, Instructions: 165
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction ID: d88667ffe02cbbb2798d41d5ad0cf6527765788d972b82ac88077c7d238bff09
Opcode Fuzzy Hash: 40d7219ce39e026dd98d18ec02294656054e4da488103e740ba1602fb3a5db7c
Instruction Fuzzy Hash: 54511A71900205BFEF209F91CC89FAFBBB8FF85B10F104259F911AA2A5D7759941CB64

Function 00401579 Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction ID: 7169477154cf1621f4f222e223ad54e678f31395e99d0ffd613e12cb64d905d3
Opcode Fuzzy Hash: 44bf211d5ecd49b3cfb3996dc98baa0f9fc545abe5e070ef87effc0df1f686f8
Instruction Fuzzy Hash: 2B511A75900245BBEF209F91CC88FEF7BB8FF85B10F104119F911BA2A5D6759941CB64

Function 0040157C Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401663
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004016A4
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016D5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004016F7

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction ID: 14f4b29c405daff92d21e2b3eea283823ae405efc36948ac0d92101f557811aa
Opcode Fuzzy Hash: c4110b1088d5ef41785dfe7ea8eaa09ab46741a105747cbb29c974859abd6495
Instruction Fuzzy Hash: DE51F9B5900245BBEF209F91CC88FEFBBB8FF85B10F104259F911AA2A5D6709944CB64

Function 00402FE9 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 0040311D
NtTerminateProcess.NTDLL ref: 00403136

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 3e1675bac70c022a4e457ffe6b5fa54937b73e0116388ba90aec32851b4d9964
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: A1412431228E088FD768EF5CA885762B7D5F798311F6643AAE809D7389EA34DC1183C5

Function 00401918 Relevance: 1.3, APIs: 1, Instructions: 57
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction ID: 41df8370e0b5f9a47a14a91e784646d83bdfa422f97ac69dcfec837627d5bcb0
Opcode Fuzzy Hash: be810bd81fc1513bf14dac74237aa616a3cfbc48422f9378a192f31e1e69cca3
Instruction Fuzzy Hash: 6D018CF520C148E7EB016A948DB1EBA36299B45324F300233B647B91F4C57C8A03E76F

Function 00401924 Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction ID: 34fc3aff5e218d4630d956a4f9c4c41b7245144a44faa4fd8074b33eba8f9d72
Opcode Fuzzy Hash: 3ad2d4b3403b833ed421c634174be831538fe621ff724946387ec8f91c54f5fa
Instruction Fuzzy Hash: 43017CF5208145E7EB015A948DB0EBA26299B45314F300237B617BA1F4C57D8602E76F

Function 00401941 Relevance: 1.3, APIs: 1, Instructions: 44
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction ID: 53d82b158b021bc4b6cde56962adc0b8c8d23177238c0d6ee964112a53f005ae
Opcode Fuzzy Hash: 6acc595331c6a8be6e6657ef398eef7c869974a8ecae4d1fde63dfd35a725e44
Instruction Fuzzy Hash: 38F0AFB6308249F7DB01AA908DB1EBA36299B54315F300633B617B91F5C57C8A12E76F

Function 00401954 Relevance: 1.3, APIs: 1, Instructions: 43
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction ID: f7568a5a22988f4b084f7ac8228f9b89e575eda69d31bfffabc36cd9cbe45c64
Opcode Fuzzy Hash: 0dfbee2e4a1c62836b2bd3ba6284fddb5b43d5507a7098400a51ac80bc720613
Instruction Fuzzy Hash: BDF0C2B6208144F7DB019AA18DB1FBA36299B44314F300233BA17B90F5C67C8612E76F

Function 0040194C Relevance: 1.3, APIs: 1, Instructions: 42
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401966

Part of subcall function 00401538: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004015F5
Part of subcall function 00401538: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401622
Part of subcall function 00401538: NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1691577546.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1691561440.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691592921.0000000000404000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691607659.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.jbxd

Similarity

API ID: Section$CreateDuplicateObjectSleepView
String ID:
API String ID: 1885482327-0
Opcode ID: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction ID: 9d6088553fbd849a34ffa1589a5f9bffd683413c7e042594889390f4c4f3f426
Opcode Fuzzy Hash: f575feb9a37452ed4573e207967fb92b714552aa85f9b6ebf0a13cec3e485039
Instruction Fuzzy Hash: 08F0C2B2208144F7DB019A958DA0FBA36299B44314F300633B617B91F5C57C8A02E72F

Analysis Process: FD47.exePID: 7772, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.5%
Total number of Nodes:	1453
Total number of Limit Nodes:	32

Executed Functions

Function 004034CC Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 417
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008001), ref: 004034EF
GetVersionExA.KERNEL32(?), ref: 00403518
GetVersionExA.KERNEL32(0000009C), ref: 0040352F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F8
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403635
OleInitialize.OLE32(00000000), ref: 0040363C
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040365A
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 0040366F
CharNextA.USER32(00000000,C:\Users\user\AppData\Local\Temp\FD47.exe,00000020,C:\Users\user\AppData\Local\Temp\FD47.exe,00000000,?,00000007,00000009,0000000B), ref: 004036A9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 004037A2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004037B3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037BF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037DB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037EC
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004037F4
DeleteFileA.KERNEL32(1033,?,00000007,00000009,0000000B), ref: 00403808
ExitProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038AE
OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 004038B3
ExitProcess.KERNEL32 ref: 004038D4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\FD47.exe,00000000,?,?,00000007,00000009,0000000B), ref: 004038E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A1B0,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\FD47.exe,00000000,?,?,00000007,00000009,0000000B), ref: 004038F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,C:\Users\user\AppData\Local\Temp\FD47.exe,00000000,?,?,00000007,00000009,0000000B), ref: 00403901
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 0040390D
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403929
DeleteFileA.KERNEL32(0041F910,0041F910,?,00425000,?,?,00000007,00000009,0000000B), ref: 00403986
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\FD47.exe,0041F910,00000001), ref: 0040399B
CloseHandle.KERNEL32(00000000,0041F910,0041F910,?,0041F910,00000000,?,00000007,00000009,0000000B), ref: 004039C8
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004039F6
OpenProcessToken.ADVAPI32(00000000), ref: 004039FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A30
ExitWindowsEx.USER32(00000002,80040002), ref: 00403A55
ExitProcess.KERNEL32 ref: 00403A76

Strings

\Temp, xrefs: 004037B9
~nsu, xrefs: 004038DF
C:\Users\user\AppData\Local\Temp\FD47.exe, xrefs: 00403675, 0040367B, 0040382A
TMP, xrefs: 004037EF
TEMP, xrefs: 004037E7
A, xrefs: 0040356A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034E1
C:\Users\user\AppData\Local\Temp\, xrefs: 00403797, 0040379C, 004037B2, 004037BE, 004037CD, 004037DA, 004037E6, 004037EE, 004038E4, 004038F5, 00403900, 0040390C, 00403919, 00403928, 004039DD
Error launching installer, xrefs: 0040386C
NSIS Error, xrefs: 00403660
UXTHEME, xrefs: 004035EC, 004035F1, 004035F7
C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00403891
.tmp, xrefs: 004038FB
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403787, 00403886, 0040392F, 00403939
C:\Users\user\AppData\Local\Temp, xrefs: 00403906, 0040390B, 00403938
", xrefs: 004036CC
Low, xrefs: 004037D5
1033, xrefs: 00403803
SeShutdownPrivilege, xrefs: 00403A0B
C:\Users\user\AppData\Local\Temp\FD47.exe, xrefs: 00403996

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "$.tmp$1033$A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\FD47.exe$C:\Users\user\AppData\Local\Temp\FD47.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\update$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2882342585-750371197
Opcode ID: d18186efe810cf451430c4e096b9aeccec46dfe8f60ebdd611bfa721823b35b5
Instruction ID: 1a4863036e4e50ed5e1acae1e6299f6db15da00d6e87979e5214c03ba8a99dba
Opcode Fuzzy Hash: d18186efe810cf451430c4e096b9aeccec46dfe8f60ebdd611bfa721823b35b5
Instruction Fuzzy Hash: 99E1D270A04354AADB21AF659D49B6F7EB89F86306F0540BFF441B61D2CB7C4A05CB2E

Function 100010D0 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(?), ref: 100010F2

Strings

Process32Next, xrefs: 10001255
CreateToolhelp32Snapshot, xrefs: 10001243
Process32First, xrefs: 1000124B
KERNEL32.DLL, xrefs: 10001225
NTDLL.DLL, xrefs: 10001127
NtQuerySystemInformation, xrefs: 1000113B

Memory Dump Source

Source File: 00000007.00000002.3858416277.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3846462996.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3869595753.0000000010002000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3889325330.0000000010004000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_FD47.jbxd

Similarity

API ID: Version
String ID: CreateToolhelp32Snapshot$KERNEL32.DLL$NTDLL.DLL$NtQuerySystemInformation$Process32First$Process32Next
API String ID: 1889659487-877962304
Opcode ID: 65e34132412926b77cd70352a95a1b322544ba155a4a88647b4c9b484df59334
Instruction ID: 3df706415bff85d1043f51983ae3f68c733976b3404a17f8fb4488dcc6387507
Opcode Fuzzy Hash: 65e34132412926b77cd70352a95a1b322544ba155a4a88647b4c9b484df59334
Instruction Fuzzy Hash: 19715871900659EFFB11DFA4CC88ADE3BEAEB483C4F250026FA19D2159E6358E49CB50

Function 00405B4A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405B73
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405BBB
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405BDC
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405BE2
FindFirstFileA.KERNEL32(00421D58,?,?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405BF3
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405CA0
FindClose.KERNEL32(00000000), ref: 00405CB1

Strings

C:\Users\user\AppData\Local\Temp\FD47.exe, xrefs: 00405B53
\*.*, xrefs: 00405BB5

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\FD47.exe$\*.*
API String ID: 2035342205-2894130919
Opcode ID: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction ID: 9e5d3321e74a3647b1fb2cdcf4bec0a51507e3563529971eb59e862f6dba24c5
Opcode Fuzzy Hash: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction Fuzzy Hash: 2B519130908B04AAEB316B61CC49BAF7AB8DF82755F14813FF851B51D2C73C5982DE69

Function 00406A88 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction ID: c2ee61ea0ab5e5811791f69f03c7ffba3fbd093a674906ee4b434ab4c587e2e9
Opcode Fuzzy Hash: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction Fuzzy Hash: 0FF18A70D04269CBDF28CF98C8946ADBBB0FF44305F24816ED856BB281D7786A86DF45

Function 004066FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(74DF3410,004225A0,C:\,00405E4B,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 0040670A
FindClose.KERNEL32(00000000), ref: 00406716

Strings

C:\, xrefs: 004066FF

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: 083b1303d1f5dd1ba3b50291930e0491dd498af142a60d7bee4daa0eb941c193
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: B3D01231515120BBC3405B38AE0C95B7E589F093747618A36F066F22E4DB74CC6286AC

Function 00403B6E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406794: GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
Part of subcall function 00406794: GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,?,C:\Users\user\AppData\Local\Temp\FD47.exe,00000009,0000000B), ref: 00403BE9
lstrlenA.KERNEL32(C:\Windows\wininit.ini,?,?,?,C:\Windows\wininit.ini,00000000,C:\Users\user\AppData\Roaming\GamePall,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410), ref: 00403C5E
lstrcmpiA.KERNEL32(?,.exe), ref: 00403C71
GetFileAttributesA.KERNEL32(C:\Windows\wininit.ini,?,C:\Users\user\AppData\Local\Temp\FD47.exe,00000009,0000000B), ref: 00403C7C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\GamePall), ref: 00403CC5

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

RegisterClassA.USER32(00423EE0), ref: 00403D02
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403D1A
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403D4F
ShowWindow.USER32(00000005,00000000,?,C:\Users\user\AppData\Local\Temp\FD47.exe,00000009,0000000B), ref: 00403D85
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403DB1
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403DBE
RegisterClassA.USER32(00423EE0), ref: 00403DC7
DialogBoxParamA.USER32(?,00000000,00403F0B,00000000), ref: 00403DE6

Strings

RichEdit, xrefs: 00403DB8
RichEd32, xrefs: 00403D99
C:\Users\user\AppData\Local\Temp\FD47.exe, xrefs: 00403B71
.DEFAULT\Control Panel\International, xrefs: 00403BD4
RichEdit20A, xrefs: 00403DA9, 00403DAF
>B, xrefs: 00403CD4
C:\Windows\wininit.ini, xrefs: 00403C2C, 00403C34, 00403C41, 00403C8B, 00403C91
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73
_Nb, xrefs: 00403CE1, 00403D49
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403BF8, 00403C00, 00403C98, 00403C9E, 00403CAE
Control Panel\Desktop\ResourceLocale, xrefs: 00403BA2
1033, xrefs: 00403B8E, 00403BE4
.exe, xrefs: 00403C6B
PB, xrefs: 00403B9A
RichEd20, xrefs: 00403D8B

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\FD47.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Windows\wininit.ini$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$>B
API String ID: 1975747703-1410561585
Opcode ID: dbde64bc3a376ab52a9cb3762a64ce6a0c2f330f4a95e62c6433b020d27b21d7
Instruction ID: 5836c5bb6a6ef8c4ff0aed12ec42ff3eebf2d58129c507535c8ab2622d1094a3
Opcode Fuzzy Hash: dbde64bc3a376ab52a9cb3762a64ce6a0c2f330f4a95e62c6433b020d27b21d7
Instruction Fuzzy Hash: 4F61D670204200AED620AF65AD45F3B3A7CEB8574AF41453FF951B62E2CB7D9D028B6D

Function 00402F5C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F70
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\FD47.exe,00000400), ref: 00402F8C

Part of subcall function 00405F1B: GetFileAttributesA.KERNEL32(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\FD47.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\FD47.exe,C:\Users\user\AppData\Local\Temp\FD47.exe,80000000,00000003), ref: 00402FD5
GlobalAlloc.KERNEL32(00000040,00000009), ref: 00403117

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 004031AE
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F66, 0040312F
Error launching installer, xrefs: 00402FAC
soft, xrefs: 0040304A
Inst, xrefs: 00403041
C:\Users\user\AppData\Local\Temp, xrefs: 00402FB7, 00402FBC, 00402FC2
C:\Users\user\AppData\Local\Temp\FD47.exe, xrefs: 00402F65
Null, xrefs: 00403053
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403160
C:\Users\user\AppData\Local\Temp\FD47.exe, xrefs: 00402F76, 00402F85, 00402F99, 00402FB6

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\FD47.exe$C:\Users\user\AppData\Local\Temp\FD47.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2433852538
Opcode ID: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction ID: 8a05da1d373fd2b3e089436e62a275652004ed3b6aa6cfe031be989f12afac8e
Opcode Fuzzy Hash: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction Fuzzy Hash: 0771E231A01218ABDB20EF65DD85B9E7BACEB44356F10813BF910BA2C1D77C9E458B5C

Function 00405FF1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
GetShortPathNameA.KERNEL32(?,NUL,00000400), ref: 0040602B

Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

GetShortPathNameA.KERNEL32(?,C:\Windows\wininit.ini,00000400), ref: 00406048
wsprintfA.USER32 ref: 00406066
GetFileSize.KERNEL32(00000000,00000000,C:\Windows\wininit.ini,C0000000,00000004,C:\Windows\wininit.ini,?,?,?,?,?), ref: 004060A1
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,NUL=C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
GlobalFree.KERNEL32(00000000), ref: 0040614F
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406156

Part of subcall function 00405F1B: GetFileAttributesA.KERNEL32(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\FD47.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Strings

NUL=C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\, xrefs: 00406061, 0040612D
C:\Windows\wininit.ini, xrefs: 0040603D, 00406043, 0040605A, 0040607C, 00406089
[Rename], xrefs: 004060D0, 004060E2
%s=%s, xrefs: 0040605C
NUL, xrefs: 00406010, 00406029, 0040605B

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$C:\Windows\wininit.ini$NUL$NUL=C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\$[Rename]
API String ID: 2171350718-3652668546
Opcode ID: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction ID: 7566a5a9e9d08134d14435fb5d3e1561ad96112206bac95af022f508aac3f812
Opcode Fuzzy Hash: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction Fuzzy Hash: 68310531200715BBC2207B659D49F6B3A5DDF85754F15003EFE42BA2C3EA7CD8228AAD

Function 0040641B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Windows\wininit.ini,00000400), ref: 00406549
GetWindowsDirectoryA.KERNEL32(C:\Windows\wininit.ini,00000400,?,00420530,00000000,004054E1,00420530,00000000), ref: 0040655C
SHGetSpecialFolderLocation.SHELL32(004054E1,00000000,?,00420530,00000000,004054E1,00420530,00000000), ref: 00406598
SHGetPathFromIDListA.SHELL32(00000000,C:\Windows\wininit.ini), ref: 004065A6
CoTaskMemFree.OLE32(00000000), ref: 004065B2
lstrcatA.KERNEL32(C:\Windows\wininit.ini,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D6
lstrlenA.KERNEL32(C:\Windows\wininit.ini,?,00420530,00000000,004054E1,00420530,00000000,00000000,00000000,00000000), ref: 00406628

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D0
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406518
C:\Windows\wininit.ini, xrefs: 00406445, 00406515, 00406516, 00406517, 00406533, 00406548, 0040655B, 00406577, 004065A2, 004065D5, 004065DB, 004065F3, 00406606, 00406621, 00406627, 0040662F, 00406659

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: C:\Windows\wininit.ini$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1428620962
Opcode ID: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction ID: f38e20b3a3e0c1a2470d5ac0c6d90f06be75126661b475aa23e0086d5b044b98
Opcode Fuzzy Hash: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction Fuzzy Hash: 9F612370900114AEDF205F24EC90BBA3BA4EB52314F52403FE913B62D1D37D8A62DB4E

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Roaming\GamePall\update,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,00000000,00000000,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Roaming\GamePall\update,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00401786
C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\INetC.dll, xrefs: 00401826, 00401842
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\INetC.dll$C:\Users\user\AppData\Local\Temp\setup.exe$C:\Users\user\AppData\Roaming\GamePall\update
API String ID: 1941528284-119878626
Opcode ID: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction ID: 0d76be79c55a0237b493b10f9ec5be6125ba7ce9be49b25e4c886387d44134cc
Opcode Fuzzy Hash: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction Fuzzy Hash: E141B731900615BBCB107BB5CC45DAF3668EF45329B61833BF422F10E1D67C8A529AAE

Function 00406726 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
wsprintfA.USER32 ref: 00406776
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 0040678A

Strings

UXTHEME, xrefs: 0040672F
\, xrefs: 0040674E
%s%s.dll, xrefs: 00406770

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 0c3db372634d2cfba6f48721b0c795b31ebca02323a8b7d7371d162bf0ec7b9a
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: FBF0FC7050021966DB15A764DD0DFEA365CAB08309F1404BEA586E20C1D6B8D5258B69

Function 004068D9 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 004068E3

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 0-292220189
Opcode ID: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction ID: 8182d74baebb800b0d472bca2432a1a472ea96a2662ae7b36db949844af6c4d7
Opcode Fuzzy Hash: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction Fuzzy Hash: DF815971E04228DBEF24CFA8C844BADBBB1FF44305F10816AD956BB281C7786986DF45

Function 00403305 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403319

Part of subcall function 00403484: SetFilePointer.KERNEL32(00000000,00000000,00000000,00403182,?), ref: 00403492

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 0040334C
SetFilePointer.KERNEL32(?,00000000,00000000,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,00004000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000), ref: 00403447

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 00403379, 0040337F

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 1092082344-292220189
Opcode ID: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction ID: 5f41a1ef9683aad456499e8308d87ccfcfa217f8aa92108fcff4f05b83e24891
Opcode Fuzzy Hash: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction Fuzzy Hash: 1F319F72A002059FC711BF2AFE849663BACE741356710C13BE814B62F0CB3859458FAD

Function 00405F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F5E
GetTempFileNameA.KERNEL32(0000000B,?,00000000,?,?,004034CA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007), ref: 00405F78

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4D
nsa, xrefs: 00405F55

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: 05c77450f8afc2c62a5a11a921c51d956a1ea51751b09822177720344b0c8500
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: 02F082363042087BDB109F55DD44BAB7B9CDF91750F14C03BFE48DA180D6B4D9988798

Function 004020A5 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 004020D0

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 004020E0
GetProcAddress.KERNEL32(00000000,?), ref: 004020F0
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040215A

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction ID: efc1da79dccaef9ffb2761d2644f5cd4432d5c2edc08e83b6cf0327c91c21bf2
Opcode Fuzzy Hash: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction Fuzzy Hash: 2B210832904214E7CF207FA58E4DAAE3A60AF44358F60413FF601B61E0DBBD49819A6E

Function 00403A7C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403A8E
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403AA2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A81
C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\, xrefs: 00403AB2

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\
API String ID: 2962429428-3482683857
Opcode ID: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction ID: f2bf129958ed6937e4157d035670f95a6da1e01cb45a681b65e96f9405f647bf
Opcode Fuzzy Hash: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction Fuzzy Hash: F4E08631640B1896C130EF7CAD4D8853B189B413357204726F1B9F20F0C738A9574EE9

Function 004031FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000009,00000000,00000000,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 00403222

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 00403277, 0040328E, 004032A4

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: FilePointer
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 973152223-292220189
Opcode ID: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction ID: 301e065564a74905a78554ad982773151ad037ba2d6e6f8d8cd401a7b941de18
Opcode Fuzzy Hash: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction Fuzzy Hash: E2318D30200219FFDB109F95ED45A9A3FA8EB05755B20847EB914E61D0D738DB509FA9

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

GetFileAttributesA.KERNEL32(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040596F: CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2

SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\GamePall\update,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00401631

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\GamePall\update
API String ID: 1892508949-3327167313
Opcode ID: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction ID: f3b3600b6319d637c5497ea1020ed17c5aedac6227b62b2eaa768bc98e31f113
Opcode Fuzzy Hash: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction Fuzzy Hash: 09115731508140EBCF306FA54D405BF23B09E96324B28453FF8D1B22E2DA3D0C42AA3E

Function 00405E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405E5B
GetFileAttributesA.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 00405E6B

Strings

C:\, xrefs: 00405E0E, 00405E13, 00405E19, 00405E54, 00405E5A, 00405E62, 00405E6A

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction ID: eca821d8ca18e415d707ee210574ba5bb9731226a542ad11e9256983d04766a4
Opcode Fuzzy Hash: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction Fuzzy Hash: F7F02831105D5116C6223336AD09AAF1644CE9732471A453FFCE1B52D2DB3C8A539CEE

Function 00406EBD Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction ID: 14484b0326c8a5630d33184448731c7578348ec986130544f859662fecd3ad08
Opcode Fuzzy Hash: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction Fuzzy Hash: 04A12471E04229CBDF28CFA8C844BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 004070BE Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction ID: 16a3963220edad981734dfbd86db7ae4535d0e52bcc7a87e0ef86c627c8cfaa4
Opcode Fuzzy Hash: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction Fuzzy Hash: 2D912370D04268CBDF28CF98C854BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 00406DD4 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction ID: e981be8a744509f315cfd76b32476d9c10b76e0a4aa84739a8d113cb33934a41
Opcode Fuzzy Hash: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction Fuzzy Hash: 37812471E04228CBDF24CFA8C844BADBBB1FF45305F24816AD856BB291C7789986DF45

Function 00406D27 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction ID: 516ab04208dd2bc2fd7cdea6c41d3130492ff38fa800e35acf718bd73fbf6333
Opcode Fuzzy Hash: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction Fuzzy Hash: A4712271E04228CBDF24CF98C844BADBBB1FF48305F14806AD856BB281C778A986DF45

Function 00406E45 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction ID: 835baf8de871759411e2c74e4a47f0112f02d54065241c3c7dcda5dc236b3f46
Opcode Fuzzy Hash: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction Fuzzy Hash: 92712571E04228CBEF28CF98C844BADBBB1FF44305F15816AD856BB281C7786996DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction ID: ccec74d0ee3a806077926e8984c2e201e8b1f3d886c73ab216be699138b2bca7
Opcode Fuzzy Hash: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction Fuzzy Hash: 39715771E04228CBEF28CF98C844BADBBB1FF44305F14806AD956BB281C778A946DF45

Function 0040247E Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC20,00000023,00000011,00000002), ref: 004024C9
RegSetValueExA.KERNEL32(?,?,?,?,0040AC20,00000000,00000011,00000002), ref: 00402509
RegCloseKey.KERNEL32(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction ID: e1e6ae2a7b536448810537a1ffa9a52b32d6c636ce9630cd27147c6707bb0a71
Opcode Fuzzy Hash: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction Fuzzy Hash: 04116371E04208AFEB10AFA5DE49AAEBA74EB84714F21443BF504F71C1DAB94D409B68

Function 00402590 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C2
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025D5
RegCloseKey.KERNEL32(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 705f8b49631554dcec7b4eb98624595070a3904998d9344154508b49de78e75c
Instruction ID: 33ff3e85e785963e302667c06a3cb1355a7acd8bf142a31c2560ef5bcfc7d759
Opcode Fuzzy Hash: 705f8b49631554dcec7b4eb98624595070a3904998d9344154508b49de78e75c
Instruction Fuzzy Hash: 2C017571904104FFE7158F54DE88ABF7BACEF81358F20443EF101A61C0DAB44E449679

Function 00405B02 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF6: GetFileAttributesA.KERNEL32(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
Part of subcall function 00405EF6: SetFileAttributesA.KERNEL32(?,00000000), ref: 00405F0F

RemoveDirectoryA.KERNEL32(?,?,?,00000000,00405CF1), ref: 00405B1D
DeleteFileA.KERNEL32(?,?,?,00000000,00405CF1), ref: 00405B25
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B3D

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction ID: eeb49a2f717892c2e0964ab94aaac89db2a73fdd151ed94c70539e0cf44bba43
Opcode Fuzzy Hash: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction Fuzzy Hash: 6CE0E531109A9097C62067349908A5B7AF8EF86314F094D3AF9A1F20D0DB38B9468EBD

Function 00406809 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 0040682F
GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: ObjectSingleWait$CodeExitProcess
String ID:
API String ID: 2567322000-0
Opcode ID: d1ff3f73a38d8d565191ded27fad29c52e1940f561348969c9200a5cb4687b78
Instruction ID: abee92fc01d0549169be82d64ea8a54f8020188e09ec540bf7ef67874f21f581
Opcode Fuzzy Hash: d1ff3f73a38d8d565191ded27fad29c52e1940f561348969c9200a5cb4687b78
Instruction Fuzzy Hash: 9DE0D832600118FBDB00AB54DD05E9E7F6EEB44704F114033F601B6190C7B59E21DB98

Function 00405F93 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000009,00000000,00000000,00000000,00000000,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,0040B8F8,00403481,00000009,00000009,00403385,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,00004000,?,00000000,0040322F), ref: 00405FA7

Strings

o be not permitted or dropped out!Please reconnect and click Retry to resume installation., xrefs: 00405F96

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: FileRead
String ID: o be not permitted or dropped out!Please reconnect and click Retry to resume installation.
API String ID: 2738559852-292220189
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: 61a6516da629700e98a59d605e8380186fb5f41ecf47873683bd74a9a2ef61d4
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: 8BE08C3220161EEBEF119E508C00AEBBB6CEB00360F004433FD25E3140E234E9218BA8

Function 0040251E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,00000000,?,?,?,?), ref: 0040254E
RegCloseKey.KERNEL32(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: acecc3e732b5dbd74a9740bd21ea2b495ff764a52a6e8e2361329d984987feff
Instruction ID: 7c766f3f1fb2abd04e903467a79d83897fdaad9d0bba0580308fe752c8381985
Opcode Fuzzy Hash: acecc3e732b5dbd74a9740bd21ea2b495ff764a52a6e8e2361329d984987feff
Instruction Fuzzy Hash: 1B11BF71905205EFDB25CF64DA985AE7BB4AF11355F20483FE042B72C0D6B88A85DA1D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction ID: c6e23866af321c238b4b59365f681da1ab702c54c00e726fca3ee5b0521d1f72
Opcode Fuzzy Hash: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction Fuzzy Hash: 5201D131B242109BE7194B38AE04B2A36A8E754315F51813AF851F61F1DB78CC129B4D

Function 00405A21 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
CloseHandle.KERNEL32(?), ref: 00405A57

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 70dcd79ab4e1e9e84cc9ba673cd08f466e07e48f17d85ed3475224309c024e1a
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: A5E04FB4600209BFEB009B64ED09F7B77ACFB04244F808421BE40F2150D67899658A78

Function 00406794 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

Part of subcall function 00406726: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
Part of subcall function 00406726: wsprintfA.USER32 ref: 00406776
Part of subcall function 00406726: LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 0040678A

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c54c0e861ed706937e547878721e8d44c7a1bbc080d115c20b20089ef5e69713
Instruction ID: 2a593beb9babc16b4b5ae8275dbdfb46ef4ebf17ea7291b62b5d373670c31446
Opcode Fuzzy Hash: c54c0e861ed706937e547878721e8d44c7a1bbc080d115c20b20089ef5e69713
Instruction Fuzzy Hash: B6E0863260421157D21067705E4897773ACAF94B54302043EF546F3144D7389C76966D

Function 00405F1B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\FD47.exe,80000000,00000003), ref: 00405F1F
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Function 00405EF6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405F0F

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction ID: 2a9487917742c73a52daa6fa2dda6e447083e2efb983b62a69771bacbdb33add
Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction Fuzzy Hash: E3D0C972504422ABD2102728AE0889BBB55DB94271702CA35FDA5A26F1DB304C569A9C

Function 004059EC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,004034BF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004059F2
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405A00

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: 42ce2bd36b25b14d2ed8d631edf33fc643f4c4eb5ed9af5e51ab4a49ffb09bba
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: 9BC04C303145419AD6505B309F4DB177A54AB50741F51553A638AE01A0DA348465DD2D

Function 10001426 Relevance: 2.5, APIs: 2, Instructions: 29stringCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,10003024,?,10003020,1000138F,10003020,00000400), ref: 10001454
GlobalFree.KERNELBASE(10003020), ref: 10001464

Memory Dump Source

Source File: 00000007.00000002.3858416277.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3846462996.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3869595753.0000000010002000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3889325330.0000000010004000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_FD47.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID:
API String ID: 1459762280-0
Opcode ID: d37c7429f21efaa5103ac68eecef2f505b672404a3497301ec3293a1c9b8d6fd
Instruction ID: 61cff6a9ed434c6726c3e265b98623322506fe6e864b2b4fb358a1092e6d6a6c
Opcode Fuzzy Hash: d37c7429f21efaa5103ac68eecef2f505b672404a3497301ec3293a1c9b8d6fd
Instruction Fuzzy Hash: 8DF0F8312152209FE315DF24CC94B9777E9FB0A385F018429E691C7278D770E804CB22

Function 0040623C Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CEA,00000000,?,?), ref: 00406265

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 57b18be241489d6c3509c0f1b2cb500900bdd64e2c84313365475615acd8ae2e
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 16E0E672010109BEDF196F50DD0AD7B371DEB04341F01492EF916D4091E6B5A9309734

Function 00405FC2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000009,00000000,00000000,00000000,00000000,004114F7,0040B8F8,00403405,0040B8F8,004114F7,o be not permitted or dropped out!Please reconnect and click Retry to resume installation.,00004000,?,00000000,0040322F,00000004), ref: 00405FD6

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d5187e51ab0d96a1766449b5dbb93cac2cdd9e80b7d20ab2fc0b5d8c8d5322e8
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 4AE0EC3221065BABDF109E659C04EEB7B6CEB05360F004437FA55E3150D675E8219BA4

Function 0040620E Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(00000000,?,00000000,?,?,00420530,?,?,0040629C,00420530,?,?,?,00000002,C:\Windows\wininit.ini), ref: 00406232

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction ID: e678259d492eddc69303d735af6c58fa5eb03465f078c5ba6a1a088e01eebb4c
Opcode Fuzzy Hash: 759d75b29ffd137612e455953a298f0698f5beae901813cd77d6ec234b014f3e
Instruction Fuzzy Hash: 64D0123244020DBBDF116F90ED01FAB3B1DEB18350F014826FE06A80A1D775D530A725

Function 00406161 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExA.KERNEL32(?,?,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0040616B

Part of subcall function 00405FF1: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
Part of subcall function 00405FF1: GetShortPathNameA.KERNEL32(?,NUL,00000400), ref: 0040602B
Part of subcall function 00405FF1: GetShortPathNameA.KERNEL32(?,C:\Windows\wininit.ini,00000400), ref: 00406048
Part of subcall function 00405FF1: wsprintfA.USER32 ref: 00406066
Part of subcall function 00405FF1: GetFileSize.KERNEL32(00000000,00000000,C:\Windows\wininit.ini,C0000000,00000004,C:\Windows\wininit.ini,?,?,?,?,?), ref: 004060A1
Part of subcall function 00405FF1: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
Part of subcall function 00405FF1: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
Part of subcall function 00405FF1: SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,NUL=C:\Users\user\AppData\Local\Temp\nskFDD4.tmp\,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
Part of subcall function 00405FF1: GlobalFree.KERNEL32(00000000), ref: 0040614F

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: File$GlobalNamePathShort$AllocCloseFreeHandleMovePointerSizelstrcpywsprintf
String ID:
API String ID: 299535525-0
Opcode ID: e5ed7b2843c229ea28ef8c1ce415cb2f1f2a9dfc0e88d0e1822b60b3228602b1
Instruction ID: 0556bd0dd0e376f9d1944fcc72f0db357db156cd0d89a75f2f72d3c973fa690a
Opcode Fuzzy Hash: e5ed7b2843c229ea28ef8c1ce415cb2f1f2a9dfc0e88d0e1822b60b3228602b1
Instruction Fuzzy Hash: F0D0C731108602FFDB111B10ED0591B7BA5FF90355F11943EF599940B1DB368461DF09

Function 00403484 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00403182,?), ref: 00403492

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Part of subcall function 00405A21: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
Part of subcall function 00405A21: CloseHandle.KERNEL32(?), ref: 00405A57

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406809: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
Part of subcall function 00406809: GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 5a6c6c0fb7ef29f4985f4766a88127bea2ca1a19b834f4a1a12170b8a3b172af
Instruction ID: dce1314ccbc215d7d9c334b017be086f7c4cc40ba0f87dfe0d8145fd67a5eb82
Opcode Fuzzy Hash: 5a6c6c0fb7ef29f4985f4766a88127bea2ca1a19b834f4a1a12170b8a3b172af
Instruction Fuzzy Hash: 2DF0B432A05121DBDB20BFA59EC49EEB2A4DF41318B25463FF502B21D1CB7C4D418A6E

Non-executed Functions

Function 004055E7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405646
GetDlgItem.USER32(?,000003EE), ref: 00405655
GetClientRect.USER32(?,?), ref: 00405692
GetSystemMetrics.USER32(00000002), ref: 00405699
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004056BA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004056CB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004056DE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004056EC
SendMessageA.USER32(?,00001024,00000000,?), ref: 004056FF
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405721
ShowWindow.USER32(?,00000008), ref: 00405735
GetDlgItem.USER32(?,000003EC), ref: 00405756
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405766
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040577F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040578B
GetDlgItem.USER32(?,000003F8), ref: 00405664

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

GetDlgItem.USER32(?,000003EC), ref: 004057A7
CreateThread.KERNEL32(00000000,00000000,Function_0000557B,00000000), ref: 004057B5
CloseHandle.KERNEL32(00000000), ref: 004057BC
ShowWindow.USER32(00000000), ref: 004057DF
ShowWindow.USER32(?,00000008), ref: 004057E6
ShowWindow.USER32(00000008), ref: 0040582C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405860
CreatePopupMenu.USER32 ref: 00405871
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405886
GetWindowRect.USER32(?,000000FF), ref: 004058A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058BF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004058FB
OpenClipboard.USER32(00000000), ref: 0040590B
EmptyClipboard.USER32 ref: 00405911
GlobalAlloc.KERNEL32(00000042,?), ref: 0040591A
GlobalLock.KERNEL32(00000000), ref: 00405924
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405938
GlobalUnlock.KERNEL32(00000000), ref: 00405951
SetClipboardData.USER32(00000001,00000000), ref: 0040595C
CloseClipboard.USER32 ref: 00405962

Strings

PB, xrefs: 004058D7

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction ID: 44a2cb424ceca129f1c721a27905a8e57bc1109532c064cce4e419f7e60c3497
Opcode Fuzzy Hash: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction Fuzzy Hash: 18A13971900608FFDB11AF64DE85AAE7BB9FB48355F00403AFA41BA1A0CB754E51DF58

Function 00404897 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048E6
SetWindowTextA.USER32(00000000,?), ref: 00404910
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 004049C1
CoTaskMemFree.OLE32(00000000), ref: 004049CC
lstrcmpiA.KERNEL32(C:\Windows\wininit.ini,00420D50), ref: 004049FE
lstrcatA.KERNEL32(?,C:\Windows\wininit.ini), ref: 00404A0A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404A1C

Part of subcall function 00405A82: GetDlgItemTextA.USER32(?,?,00000400,00404A53), ref: 00405A95

Part of subcall function 00406666: CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
Part of subcall function 00406666: CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
Part of subcall function 00406666: CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
Part of subcall function 00406666: CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404ADA
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AF5

Part of subcall function 00404C4E: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
Part of subcall function 00404C4E: wsprintfA.USER32 ref: 00404CF4
Part of subcall function 00404C4E: SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

A, xrefs: 004049BA
C:\Users\user\AppData\Roaming\GamePall, xrefs: 004049E7
PB, xrefs: 00404994
C:\Windows\wininit.ini, xrefs: 004049F8, 004049FD, 00404A08

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\GamePall$C:\Windows\wininit.ini$PB
API String ID: 2624150263-3088350716
Opcode ID: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction ID: 03633cdec68ae3b48ba4c7d33c4768738bfb21d85bfcf2e4b9185cba9ee35c0f
Opcode Fuzzy Hash: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction Fuzzy Hash: 7DA150B1A00208AADB11EFA5DD45BAFB6B8EF84315F10803BF601B62D1D77C99418F6D

Function 00402173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022AA

Strings

C:\Users\user\AppData\Roaming\GamePall\update, xrefs: 00402238

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\GamePall\update
API String ID: 123533781-3327167313
Opcode ID: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction ID: 4a55140eb955682c0845ac661669d1effe53c60cfc8a987c49de3bb9103baba8
Opcode Fuzzy Hash: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction Fuzzy Hash: B2513575A00208AFDF10DFE4CA88A9D7BB5EF48314F2045BAF505EB2D1DA799981CB54

Function 004027AA Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 004027B9

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction ID: 9767438fe71d1176ff9aac627a01f72906af616df08219c0cc944b63bddc0547
Opcode Fuzzy Hash: 3697544f2be0618a58616ff40495ed399055e36512a5e022deae8fba2564a7e1
Instruction Fuzzy Hash: CCF0A0726082049AD710EBA49A49AEEB7689F51324F60057BF142F20C1D6B889459B2A

Function 00404E0A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E21
GetDlgItem.USER32(?,00000408), ref: 00404E2E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E7D
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E94
SetWindowLongA.USER32(?,000000FC,0040541D), ref: 00404EAE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EC0
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404ED4
SendMessageA.USER32(?,00001109,00000002), ref: 00404EEA
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404EF6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F06
DeleteObject.GDI32(00000110), ref: 00404F0B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404F36
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404FDC
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 0040500C

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

SendMessageA.USER32(?,00001100,00000000,?), ref: 00405020
GetWindowLongA.USER32(?,000000F0), ref: 0040504E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 0040505C
ShowWindow.USER32(?,00000005), ref: 0040506C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405167
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004051CC
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004051E1
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405205
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405225
ImageList_Destroy.COMCTL32(?), ref: 0040523A
GlobalFree.KERNEL32(?), ref: 0040524A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004052C3
SendMessageA.USER32(?,00001102,?,?), ref: 0040536C
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040537B
InvalidateRect.USER32(?,00000000,00000001), ref: 004053A6
ShowWindow.USER32(?,00000000), ref: 004053F4
GetDlgItem.USER32(?,000003FE), ref: 004053FF
ShowWindow.USER32(00000000), ref: 00405406

Strings

N, xrefs: 004050A5
, xrefs: 004053DE
M, xrefs: 00404FC4

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction ID: c306c4130ea67d8582adb4b0d0e706bf782d7aff15223233fd0d43401108afdf
Opcode Fuzzy Hash: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction Fuzzy Hash: 6C025CB0A00609AFDB209F94DD45AAE7BB5FB84354F10817AF610BA2E1D7789D42CF58

Function 00403F0B Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F47
ShowWindow.USER32(?), ref: 00403F67
GetWindowLongA.USER32(?,000000F0), ref: 00403F79
ShowWindow.USER32(?,00000004), ref: 00403F92
DestroyWindow.USER32 ref: 00403FA6
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403FBF
GetDlgItem.USER32(?,?), ref: 00403FDE
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403FF2
IsWindowEnabled.USER32(00000000), ref: 00403FF9
GetDlgItem.USER32(?,00000001), ref: 004040A4
GetDlgItem.USER32(?,00000002), ref: 004040AE
SetClassLongA.USER32(?,000000F2,?), ref: 004040C8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404119
GetDlgItem.USER32(?,00000003), ref: 004041BF
ShowWindow.USER32(00000000,?), ref: 004041E0
EnableWindow.USER32(?,?), ref: 004041F2
EnableWindow.USER32(?,?), ref: 0040420D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404223
EnableMenuItem.USER32(00000000), ref: 0040422A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404242
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404255
lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 0040427F
SetWindowTextA.USER32(?,00420D50), ref: 0040428E
ShowWindow.USER32(?,0000000A), ref: 004043C2

Strings

PB, xrefs: 0040426F

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: PB
API String ID: 1860320154-3196168531
Opcode ID: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction ID: 6b3c419a8b2de2434844e8cd53afab52d63163afb5b1bd925d395a768d9dd0e6
Opcode Fuzzy Hash: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction Fuzzy Hash: ECC1D2B1A00204BBCB206F61EE45E2B3A78EB85745F41053EF781B61F1CB3998929B5D

Function 00404570 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004045FB
GetDlgItem.USER32(00000000,000003E8), ref: 0040460F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040462D
GetSysColor.USER32(?), ref: 0040463E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040464D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040465C
lstrlenA.KERNEL32(?), ref: 0040465F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040466E
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404683
GetDlgItem.USER32(?,0000040A), ref: 004046E5
SendMessageA.USER32(00000000), ref: 004046E8
GetDlgItem.USER32(?,000003E8), ref: 00404713
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404753
LoadCursorA.USER32(00000000,00007F02), ref: 00404762
SetCursor.USER32(00000000), ref: 0040476B
LoadCursorA.USER32(00000000,00007F00), ref: 00404781
SetCursor.USER32(00000000), ref: 00404784
SendMessageA.USER32(00000111,00000001,00000000), ref: 004047B0
SendMessageA.USER32(00000010,00000000,00000000), ref: 004047C4

Strings

6B, xrefs: 0040476F
N, xrefs: 00404701

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction ID: 424ea1d81b5f8fd67bb79b8421ee67f108f717641e3cc5fc4ea293435da972af
Opcode Fuzzy Hash: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction Fuzzy Hash: CE6190B1A40208BFDB109F61DD45B6A7B69FB84715F10843AFB01BB2D1C7B8A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction ID: bc851ab26da2bb863bf3a2ee07eb2f950de800ada4cbee7b2d64f78586a04119
Opcode Fuzzy Hash: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction Fuzzy Hash: 2C419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C734DA55DFA4

Function 004054A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
SetWindowTextA.USER32(00420530,00420530), ref: 00405517
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

4/@, xrefs: 004054EF, 00405501

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: 4/@
API String ID: 2531174081-3101945251
Opcode ID: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction ID: 7ab3267fb946cf8e7efc5916356ec1270af3577e2396c2c3629ce5ef3fcb69de
Opcode Fuzzy Hash: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction Fuzzy Hash: 0F217A71E00118BBCF119FA5DD8099EBFB9EF09354F04807AF944A6291C7788A90CFA8

Function 00406666 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\FD47.exe,004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406667
*?|<>/":, xrefs: 004066AE
C:\Users\user\AppData\Local\Temp\FD47.exe, xrefs: 00406666

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\FD47.exe
API String ID: 589700163-3815840707
Opcode ID: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction ID: 80d428334b402c3338f843ea799862c1973996ffb1638880579f4ae0c72fc655
Opcode Fuzzy Hash: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction Fuzzy Hash: 7E1108518047902DEB3206340C04B7B7F894F977A0F2A087FD8C6722C2D67E5C62967D

Function 00402EBD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402ED5
GetTickCount.KERNEL32 ref: 00402EF3
wsprintfA.USER32 ref: 00402F21

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

CreateDialogParamA.USER32(0000006F,00000000,00402E25,00000000), ref: 00402F45
ShowWindow.USER32(00000000,00000005), ref: 00402F53

Part of subcall function 00402EA1: MulDiv.KERNEL32(?,00000064,?), ref: 00402EB6

Strings

... %d%%, xrefs: 00402F1B
#Vh%.@, xrefs: 00402F34

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%$#Vh%.@
API String ID: 722711167-1706192003
Opcode ID: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction ID: ac0ca11ee9366edb0cc6a28cc5aeb329eacd7d00ab00b3c3670f6d564c8935e4
Opcode Fuzzy Hash: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction Fuzzy Hash: 3F01A170542225EBCB21BB50EF0CBAB3778EB40744B04443BF505B21D0C7F894469AEE

Function 0040446C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404489
GetSysColor.USER32(00000000), ref: 004044C7
SetTextColor.GDI32(?,00000000), ref: 004044D3
SetBkMode.GDI32(?,?), ref: 004044DF
GetSysColor.USER32(?), ref: 004044F2
SetBkColor.GDI32(?,?), ref: 00404502
DeleteObject.GDI32(?), ref: 0040451C
CreateBrushIndirect.GDI32(?), ref: 00404526

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction ID: 76b6fc4927f6120469f5ffa52701fcd3ddd76896e52d32ad6f55637f73cee333
Opcode Fuzzy Hash: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction Fuzzy Hash: 9E2147B1501704AFCB31DF68ED08B5BBBF8AF41715B04892EEA96A26E0D734E904CB54

Function 00404D58 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404D73
GetMessagePos.USER32 ref: 00404D7B
ScreenToClient.USER32(?,?), ref: 00404D95
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404DA7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404DCD

Strings

f, xrefs: 00404DA9

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: de178be9688f757f82ef56a4cbeb6693d0582b60b2ea90e1a00f6814b48fd044
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: BB014871900219BADB01DBA4DD85BFEBBF8AF95B11F10016ABA40B61C0C6B499058BA4

Function 0040596F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2
GetLastError.KERNEL32 ref: 004059C6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004059DB
GetLastError.KERNEL32 ref: 004059E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405995
!9@, xrefs: 00405984

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: !9@$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-2369717338
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: 4cd508ff09270142ca7a6984d66ae253fefa4e1f6983b248f3af4f59f5a14231
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 610108B1D00259DAEF109BA0CA45BEFBBB8EB04354F00403AD645B6290D7789648CF99

Function 00402E25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E40
wsprintfA.USER32 ref: 00402E74
SetWindowTextA.USER32(?,?), ref: 00402E84
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E96

Strings

verifying installer: %d%%, xrefs: 00402E69, 00402E72
unpacking data: %d%%, xrefs: 00402E62

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction ID: 7ad4584a5e884be7344c254f70e0401137e7e46ce86c3cf658bb2ab9d23be74a
Opcode Fuzzy Hash: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction Fuzzy Hash: 1DF01D7054020DBAEF219F60DE0ABAE3769EB44344F00803AFA16B91D0DBB899558F99

Function 004027E8 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402849
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402865
GlobalFree.KERNEL32(?), ref: 004028A4
GlobalFree.KERNEL32(00000000), ref: 004028B7
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028D3
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028E6

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction ID: cd924008ac91bdcd896aacfcc8aadc4f9c7de1b4393fc14a433ce499bdbf1d56
Opcode Fuzzy Hash: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction Fuzzy Hash: D931AC32800128ABDF216FA5DE49D9E7A75FF08364F24423AF450B62D0CB7949419F68

Function 1000103F Relevance: 9.1, APIs: 6, Instructions: 55synchronizationCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00100401,00000000,?,0000025E,?,00000000,?), ref: 10001054
EnumWindows.USER32(10001007,?), ref: 10001074
GetExitCodeProcess.KERNEL32(00000000,?), ref: 10001084
WaitForSingleObject.KERNEL32(00000000,00000BB8), ref: 1000109D
TerminateProcess.KERNEL32(00000000,00000000), ref: 100010AE
CloseHandle.KERNEL32(00000000), ref: 100010C5

Memory Dump Source

Source File: 00000007.00000002.3858416277.0000000010001000.00000020.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.3846462996.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3869595753.0000000010002000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.3889325330.0000000010004000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_FD47.jbxd

Similarity

API ID: Process$CloseCodeEnumExitHandleObjectOpenSingleTerminateWaitWindows
String ID:
API String ID: 3465249596-0
Opcode ID: 45a2251c50cfe7217ad4567bb79eedec0e3199e983198285888405aa9b7494a4
Instruction ID: 6b4dcd5717a232181223c093e4f4244ae1ce1555a3c8e15b92772d9ea2fb9ae7
Opcode Fuzzy Hash: 45a2251c50cfe7217ad4567bb79eedec0e3199e983198285888405aa9b7494a4
Instruction Fuzzy Hash: 5211E235A00299EFFB00DFA5CCC8AEE77BCEB456C5F014069FA4192149D7B49981CB62

Function 00404C4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
wsprintfA.USER32 ref: 00404CF4
SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

%u.%u%s%s, xrefs: 00404CD6
PB, xrefs: 00404CDE

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$PB
API String ID: 3540041739-838025833
Opcode ID: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction ID: 635705270cf82d3fa6c033b13715314544988666452c3f341a93ad76d23c3d90
Opcode Fuzzy Hash: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction Fuzzy Hash: 5F11E77360512837EB00656D9D45EAE3298DB85374F26423BFE26F71D1E978CC1286E8

Function 00402D3B Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402DDB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DE4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402DFB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E06

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 6a17d2dfc8014f9998472e4bb2df9c50261cd009cc462a72ab7525fe56808e65
Instruction ID: 1f7d8097ab2fb743d310579a2b4365e3e31c1a4ec17ce584dda370d325fd3950
Opcode Fuzzy Hash: 6a17d2dfc8014f9998472e4bb2df9c50261cd009cc462a72ab7525fe56808e65
Instruction Fuzzy Hash: 1D214B7150010CBBDF129F90CE89EEB7B7DEF44344F11007AF955B11A0D7B49EA49AA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction ID: cb7cd4706ec086029cb46641885d9617bace417a5341e65c45b3777010ef1041
Opcode Fuzzy Hash: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction Fuzzy Hash: 35212A72E00109AFDF15DFA4DD85AAEBBB5EB88300F24417EF911F62A0DB389941DB14

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction ID: bfe7ce59390996d5b2ac71ca67757b7c78ff13e1b53bdd881068f9c0e557254e
Opcode Fuzzy Hash: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction Fuzzy Hash: 66018072504340AEE7007BB0AF8AA9A7FE8E755701F109439F241B61E2CB790449CB6C

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction ID: a12cfbdd51ff26f17676da16b1bc06906883597644a76ef85f46b7bf1251d8d3
Opcode Fuzzy Hash: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction Fuzzy Hash: 2A218271948208BEEB059FF5DA8AAAD7FB4EF84304F20447EF101B61D1D7B989819B18

Function 00405D1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D20
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D29
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D1A

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction ID: 6a6775ee8fa4d5d8d60a890cb1840bbff54d6a4bc9e312217f61a2b57c53a4e0
Opcode Fuzzy Hash: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction Fuzzy Hash: 82D0A7625015307AD20167154C09DDF29488F523017094027F501B7191C67C5C1187FD

Function 00405DB3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,C:\Users\user\AppData\Local\Temp\FD47.exe), ref: 00405DC1
CharNextA.USER32(00000000), ref: 00405DC6
CharNextA.USER32(00000000), ref: 00405DDA

Strings

C:\, xrefs: 00405DB4

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction ID: a81d310af092f64b8c374c4571b8fed5a60269d48026fa3bbeeaae68e06855d2
Opcode Fuzzy Hash: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction Fuzzy Hash: 71F09661904F542BFB3293648C4CB776B8DCF55351F28947BE6807A6C1C27C59808FEA

Function 0040541D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040544C
CallWindowProcA.USER32(?,?,?,?), ref: 0040549D

Part of subcall function 00404451: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404463

Strings

, xrefs: 0040542D

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction ID: ce4d6245f7a5538c18ae28323cba1b5bdda0ccdff68052f186ad3da5f1ae13b7
Opcode Fuzzy Hash: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction Fuzzy Hash: 2A015E31200608AFDF216F51DD80BAF3A66EB84716F104537FA05761D2C7799CD29F6A

Function 0040626F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Windows\wininit.ini,00420530,?,?,?,00000002,C:\Windows\wininit.ini,?,00406527,80000002), ref: 004062B5
RegCloseKey.ADVAPI32(?,?,00406527,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Windows\wininit.ini,C:\Windows\wininit.ini,C:\Windows\wininit.ini,?,00420530), ref: 004062C0

Strings

C:\Windows\wininit.ini, xrefs: 00406272, 004062A6

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Windows\wininit.ini
API String ID: 3356406503-2725141966
Opcode ID: b5b3bad3c76d40b2ede80ce474e794f1db4bf40d8bfbb80b5b2804fbfeedd4a0
Instruction ID: 5c8aa4f59809ec7c4ed175be077f356401e74c3ba082423fbe1b6bbc42bea5f4
Opcode Fuzzy Hash: b5b3bad3c76d40b2ede80ce474e794f1db4bf40d8bfbb80b5b2804fbfeedd4a0
Instruction Fuzzy Hash: 8101BC72100209ABDF229F60CC09FDB3FA8EF45364F01407AFD56A6190D638C974CBA8

Function 00405D61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\FD47.exe,C:\Users\user\AppData\Local\Temp\FD47.exe,80000000,00000003), ref: 00405D67
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\FD47.exe,C:\Users\user\AppData\Local\Temp\FD47.exe,80000000,00000003), ref: 00405D75

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405D61

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-47812868
Opcode ID: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction ID: 27c40c0738421aba4af956c8f0f705930dfe744a77a65273bf6dbb66402e0641
Opcode Fuzzy Hash: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction Fuzzy Hash: CBD0A772409D706EE31353208C04B8F6A48CF13300F0D4063E481A6190C2785C424BFD

Function 00405E80 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405EA8
CharNextA.USER32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EB9
lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

Memory Dump Source

Source File: 00000007.00000002.3392640187.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3392605209.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392672177.0000000000408000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000040A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000422000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.000000000042A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3392772563.0000000000434000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000436000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000439000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000446000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000454000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.000000000045B000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.3425613931.0000000000462000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_FD47.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 98ea32bb50e75ca8be10b873c57fc005eda9f523d07111d413316ed06cfa332a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 5FF06235104918AFCB129BA5DD4099EBFA8EF55350B2540B9E880F7211D674DF019BA9

Analysis Process: 1B6E.exePID: 7888, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	20.2%
Signature Coverage:	1.5%
Total number of Nodes:	1542
Total number of Limit Nodes:	93

Executed Functions

Function 03CD2054 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03CD3508: EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
Part of subcall function 03CD3508: GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
Part of subcall function 03CD3508: HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
Part of subcall function 03CD3508: LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

GetCurrentHwProfileA.ADVAPI32(?,?,0000011C), ref: 03CD210B
GetSystemInfo.KERNEL32(?,?,0000011C), ref: 03CD2132
GlobalMemoryStatusEx.KERNEL32(?), ref: 03CD2166
EnumDisplayDevicesA.USER32(00000000,00000002,?,00000001), ref: 03CD21E8

Strings

@, xrefs: 03CD215D
- RAM: %d GB, xrefs: 03CD217D
- HWID: %s, xrefs: 03CD211F
- CPU: %s (%d cores), xrefs: 03CD2144
- VideoAdapter #%d: %s, xrefs: 03CD21B4

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocCurrentDevicesDisplayEnterEnumGlobalInfoLeaveMemoryProcessProfileStatusSystem
String ID: - CPU: %s (%d cores)$- HWID: %s$- RAM: %d GB$- VideoAdapter #%d: %s$@
API String ID: 3018433743-565344305
Opcode ID: 102254f9594460b48ed672f7fda808a53c6df6d5f81d9d416d07b3e94975a87f
Instruction ID: b72367c642aeec6094307ad2ff4f53d33d5a59c43a0fe165c7367ce7d5f8a8e0
Opcode Fuzzy Hash: 102254f9594460b48ed672f7fda808a53c6df6d5f81d9d416d07b3e94975a87f
Instruction Fuzzy Hash: F241B1716043459BD725EF14D885BABB7E8EB88310F04492DFA89DB241E771E944CBA2

Function 03CD1C94 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03CD46D4: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03CD4812), ref: 03CD46E6
Part of subcall function 03CD46D4: LoadLibraryA.KERNEL32(ntdl,?,?,?,?,?,?,?,03CD4812), ref: 03CD46F3

CryptProtectData.CRYPT32(?,?,00000000,00000000,00000000,00000000,?), ref: 03CD1D29

Strings

CRYPT32.dll, xrefs: 03CD1CC2
Poverty is the parent of crime., xrefs: 03CD1D12

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CryptDataHandleLibraryLoadModuleProtect
String ID: CRYPT32.dll$Poverty is the parent of crime.
API String ID: 1163816349-1885057629
Opcode ID: ace7914efc292c826ac67652f20f64e7b3fdd98af378947a8c70ba61d1edbf32
Instruction ID: a14d7ca9fa25f49fb2602a87287d94709dab0c3820cde1a65abc0358d9d051d5
Opcode Fuzzy Hash: ace7914efc292c826ac67652f20f64e7b3fdd98af378947a8c70ba61d1edbf32
Instruction Fuzzy Hash: 76114DB5D0020CABCB11DF95C8808EFBBBDEB48210F14456AE905F7244E770AE05CBA0

Function 03CD21F5 Relevance: 38.8, APIs: 13, Strings: 9, Instructions: 304
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(03CD84D4,00000DA3), ref: 03CD220A
CreateMutexA.KERNEL32(00000000,00000000,1e7f31ac-1494-47cc-9633-054c20e7432e), ref: 03CD2222
GetLastError.KERNEL32 ref: 03CD2235

Strings

- OperationSystem: %d:%d:%d, xrefs: 03CD229D
kernel32, xrefs: 03CD23AC
$, xrefs: 03CD2570
1e7f31ac-1494-47cc-9633-054c20e7432e, xrefs: 03CD2219, 03CD2585
$d.log, xrefs: 03CD25EB
@, xrefs: 03CD2551
- UserAgent: %s, xrefs: 03CD2526
systemd, xrefs: 03CD2566
shell32, xrefs: 03CD2358

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CountCreateCriticalErrorInitializeLastMutexSectionSpin
String ID: $$$d.log$- OperationSystem: %d:%d:%d$- UserAgent: %s$1e7f31ac-1494-47cc-9633-054c20e7432e$@$kernel32$shell32$systemd
API String ID: 2005177960-3436640841
Opcode ID: 9ac01e6a725ba1e834275bf419cd8bd9771ca392580e2a2f903e9a2115d65b90
Instruction ID: 7ffd725ec8e185b6f31b3d4c6e674419bd1f3f948d39d994c9295c1199a1c4eb
Opcode Fuzzy Hash: 9ac01e6a725ba1e834275bf419cd8bd9771ca392580e2a2f903e9a2115d65b90
Instruction Fuzzy Hash: A4C1E034904388AAEB16FFA0EC59BEC7BB5AF05300F044099F701EE2D5DB755A56DB22

Function 00A25B80 Relevance: 30.7, APIs: 12, Strings: 1, Instructions: 7953COMMON

Download Yara Rule

Strings

d, xrefs: 00A25BA9

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 99944d4ad3552910ec763c1fe61a12c948f8ac68fe7bda139709f00a7b1aa6a5
Instruction ID: afe81be8ce81833564baffecbc3546e5077d9a7ca4dc104b00d6c80f6c6b35a6
Opcode Fuzzy Hash: 99944d4ad3552910ec763c1fe61a12c948f8ac68fe7bda139709f00a7b1aa6a5
Instruction Fuzzy Hash: 98144771D04A2CCACB66DF68DC916AEB775FF56344F1082E9E40A7A241EB319AD1CF40

Function 03CD4BA2 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03CD46D4: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03CD4812), ref: 03CD46E6
Part of subcall function 03CD46D4: LoadLibraryA.KERNEL32(ntdl,?,?,?,?,?,?,?,03CD4812), ref: 03CD46F3

GetSystemMetrics.USER32(0000004C,?,0000011C), ref: 03CD4C13
GetSystemMetrics.USER32(0000004D,?,0000011C), ref: 03CD4C1A
ReleaseDC.USER32(00000000,00000000,?,?,0000011C), ref: 03CD4E1A

Part of subcall function 03CD3508: EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
Part of subcall function 03CD3508: GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
Part of subcall function 03CD3508: HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
Part of subcall function 03CD3508: LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

Part of subcall function 03CD3D76: EnterCriticalSection.KERNEL32(03CD84D4,?,0000011C), ref: 03CD3D88

Part of subcall function 03CD3536: GetProcessHeap.KERNEL32(00000000,00000000,03CD264F), ref: 03CD353D
Part of subcall function 03CD3536: HeapFree.KERNEL32(00000000), ref: 03CD3544

Strings

U, xrefs: 03CD4BD3
gdi3, xrefs: 03CD4BBE
(, xrefs: 03CD4CED
er32, xrefs: 03CD4BDA
2, xrefs: 03CD4BCA
6, xrefs: 03CD4CF9
- ScreenSize: {lWidth=%d, lHeight=%d}, xrefs: 03CD4C9D

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: Heap$CriticalSection$EnterMetricsProcessSystem$AllocFreeHandleLeaveLibraryLoadModuleRelease
String ID: ($- ScreenSize: {lWidth=%d, lHeight=%d}$2$6$U$er32$gdi3
API String ID: 1661398203-1028866296
Opcode ID: a571c1c2785f5413cad09b1a8f202a0a2bb80665f07c71d140f2f7b165969ba1
Instruction ID: 21bec3837eb6cf3978de37e8babd64a0a4ef834b7223ff4578b08d933df3d2f3
Opcode Fuzzy Hash: a571c1c2785f5413cad09b1a8f202a0a2bb80665f07c71d140f2f7b165969ba1
Instruction Fuzzy Hash: B5719D75D01308ABDB25EFA5EC45BAEBB78EF04700F14805AF605EB290EB709A14DB65

Function 03CD446C Relevance: 16.7, APIs: 8, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03CD407D: GetFileAttributesW.KERNEL32(016200F8,03CD1035,016200F8,?), ref: 03CD407E

Part of subcall function 03CD3508: EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
Part of subcall function 03CD3508: GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
Part of subcall function 03CD3508: HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
Part of subcall function 03CD3508: LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

EnterCriticalSection.KERNEL32(03CD84D4), ref: 03CD44F5
LeaveCriticalSection.KERNEL32(03CD84D4), ref: 03CD4541
EnterCriticalSection.KERNEL32(03CD84D4), ref: 03CD45C4
LeaveCriticalSection.KERNEL32(03CD84D4), ref: 03CD45FD
EnterCriticalSection.KERNEL32(03CD84D4), ref: 03CD463A
LeaveCriticalSection.KERNEL32(03CD84D4), ref: 03CD467D
EnterCriticalSection.KERNEL32(03CD84D4), ref: 03CD4696
LeaveCriticalSection.KERNEL32(03CD84D4), ref: 03CD46BF

Part of subcall function 03CD42EC: GetModuleHandleA.KERNEL32(ntdll,NtQuerySystemInformation,?,00000000,?,?,?,?,?,03CD4574), ref: 03CD4305
Part of subcall function 03CD42EC: GetProcAddress.KERNEL32(00000000,?,?,?,?,03CD4574), ref: 03CD430E
Part of subcall function 03CD42EC: GetModuleHandleA.KERNEL32(ntdll,NtQueryObject,?,?,?,?,03CD4574), ref: 03CD431F
Part of subcall function 03CD42EC: GetProcAddress.KERNEL32(00000000,?,?,?,?,03CD4574), ref: 03CD4322
Part of subcall function 03CD42EC: OpenProcess.KERNEL32(00000040,00000000,00000000,?,?,?,?,03CD4574), ref: 03CD43A4
Part of subcall function 03CD42EC: GetCurrentProcess.KERNEL32(03CD4574,00000000,00000000,00000002,?,?,?,?,03CD4574), ref: 03CD43C0
Part of subcall function 03CD42EC: DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,03CD4574), ref: 03CD43CF
Part of subcall function 03CD42EC: CloseHandle.KERNEL32(03CD4574,?,?,?,?,03CD4574), ref: 03CD43FF

Part of subcall function 03CD3536: GetProcessHeap.KERNEL32(00000000,00000000,03CD264F), ref: 03CD353D
Part of subcall function 03CD3536: HeapFree.KERNEL32(00000000), ref: 03CD3544

Strings

@, xrefs: 03CD44DB
\Network\Cookies, xrefs: 03CD4561
\??\%s, xrefs: 03CD44A4

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$HandleHeapProcess$AddressModuleProc$AllocAttributesCloseCurrentDuplicateFileFreeOpen
String ID: @$\??\%s$\Network\Cookies
API String ID: 3156071667-2791195959
Opcode ID: 7823d7036443e71484c81b2afa4b790fa893b9b21fdfec352221815b9ba217b9
Instruction ID: a557bbf93cf2d5e508027207b880b06ea4370d3b94d2e9d9f7ca05d5c115aa0f
Opcode Fuzzy Hash: 7823d7036443e71484c81b2afa4b790fa893b9b21fdfec352221815b9ba217b9
Instruction Fuzzy Hash: 0B714A79940308AFEB48EF90D859FADBBB5FB04704F108025F701EA1D1EBB0AA55DB51

Function 03CD1000 Relevance: 12.7, APIs: 2, Strings: 6, Instructions: 667
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03CD407D: GetFileAttributesW.KERNEL32(016200F8,03CD1035,016200F8,?), ref: 03CD407E

Part of subcall function 03CD3508: EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
Part of subcall function 03CD3508: GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
Part of subcall function 03CD3508: HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
Part of subcall function 03CD3508: LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

EnterCriticalSection.KERNEL32(03CD84D4), ref: 03CD1668
LeaveCriticalSection.KERNEL32(03CD84D4), ref: 03CD1681

Strings

%s\*, xrefs: 03CD112A
Telegram, xrefs: 03CD166E
7a?=, xrefs: 03CD16A3
$Lr, xrefs: 03CD1281
%s\%s, xrefs: 03CD11A2
%s%s, xrefs: 03CD1487, 03CD17C7, 03CD195D, 03CD19C2

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterHeapLeave$AllocAttributesFileProcess
String ID: $Lr$%s%s$%s\%s$%s\*$7a?=$Telegram
API String ID: 2679619987-1537637304
Opcode ID: 3e7dcb6f0682bbc60d0f429046835096f53ceb54c34c340d5420bde4745a71e0
Instruction ID: e45a77bf9e2873f2342d7d37cdf7eb429d1e91b4763138cbe599ac613cda5e32
Opcode Fuzzy Hash: 3e7dcb6f0682bbc60d0f429046835096f53ceb54c34c340d5420bde4745a71e0
Instruction Fuzzy Hash: FD321675E003645BDB65EBA49890BFDB3B5AF40210F1D405AF606EF2A0EB748F85C792

Function 00A2F990 Relevance: 11.6, APIs: 4, Strings: 1, Instructions: 2890COMMON

Download Yara Rule

Strings

d, xrefs: 00A2F999

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 9e867906676acc343469547a3dae0106956b39d4528ff60a8ed7538646f9ef88
Instruction ID: c063e3c9417df3404226f53b2f46ff33ffe855622e9405c9331772f4ae624e9c
Opcode Fuzzy Hash: 9e867906676acc343469547a3dae0106956b39d4528ff60a8ed7538646f9ef88
Instruction Fuzzy Hash: 3B631671C04A2CCACB26DF68D9916AEF775FF56345F1082DAE40A3A241EB319AD1DF40

Function 00A33FE0 Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 705
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00A33FE9

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 97110aebff3be89f47c9114d1fae985cad0b0e319f6a99a8898306cc1bfee4a0
Instruction ID: 7f93a892f485b1e20521a602bcf88ff09255465f69949223f9e64943a6c29624
Opcode Fuzzy Hash: 97110aebff3be89f47c9114d1fae985cad0b0e319f6a99a8898306cc1bfee4a0
Instruction Fuzzy Hash: 3F724571D04A1CDACB15DFA8D991AEEF775FF5A344F108299E40A3A241EB31AA91CF40

Function 00A359F0 Relevance: 10.0, APIs: 2, Strings: 1, Instructions: 5515COMMON

Download Yara Rule

Strings

d, xrefs: 00A359F9

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 466b5e285d580189ecba216458b566df2d7ddeae76bfff42764cea4ef70aa7b3
Instruction ID: 6f92fdb7da914e45efda7b4ab402ff3d84f2e61e598b8bf9cee3ae142b53eefe
Opcode Fuzzy Hash: 466b5e285d580189ecba216458b566df2d7ddeae76bfff42764cea4ef70aa7b3
Instruction Fuzzy Hash: A8D32771D04A2CCACB26DF68D9916AEF775FF56344F1082CAE40A3A241EB319AD1DF41

Function 03CD484B Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 231
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,00000020,00003000,00000040,0000011C,?,?,?,?,?,03CD22C4), ref: 03CD486C

Part of subcall function 03CD46D4: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03CD4812), ref: 03CD46E6
Part of subcall function 03CD46D4: LoadLibraryA.KERNEL32(ntdl,?,?,?,?,?,?,?,03CD4812), ref: 03CD46F3

GetCurrentProcess.KERNEL32(03CD22C4), ref: 03CD48E0
IsWow64Process.KERNEL32(00000000), ref: 03CD48E7

Strings

l, xrefs: 03CD488C
ntdl, xrefs: 03CD4889

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentHandleLibraryLoadModuleVirtualWow64
String ID: l$ntdl
API String ID: 1207166019-924918826
Opcode ID: 2787c983665d700ff01ed4d04de887d15c833e6df294e154baf77541972f143a
Instruction ID: 60438b9ab4ae8391bca8fea4223f789e2b3ff0920842cfa3bc1d13e02fcc8977
Opcode Fuzzy Hash: 2787c983665d700ff01ed4d04de887d15c833e6df294e154baf77541972f143a
Instruction Fuzzy Hash: 0981A232609704AAEB2CEE56E865B79337CFB00710F18055AF309DF2C4DFB49A548706

Function 00A7FCA5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___scrt_release_startup_lock.LIBCMT ref: 00A7FCF5
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00A7FD09
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 00A7FD2F
___scrt_uninitialize_crt.LIBCMT ref: 00A7FD72

Strings

VPWh, xrefs: 00A7FD4E

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___scrt_release_startup_lock___scrt_uninitialize_crt
String ID: VPWh
API String ID: 3089971210-353207083
Opcode ID: 556722f688ed0fa0e77328f477beee3f1703c49df939f9c51f2c6f05724de7d2
Instruction ID: 975ba02966a8d4453a565ac13f121d88c4db732d6b3e437306c87b33535297ec
Opcode Fuzzy Hash: 556722f688ed0fa0e77328f477beee3f1703c49df939f9c51f2c6f05724de7d2
Instruction Fuzzy Hash: F22149326083116EDF317B686D06A6E67A0AF42324F30C53AF898271C3DF254E018390

Function 03CD4E27 Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 286
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03CD407D: GetFileAttributesW.KERNEL32(016200F8,03CD1035,016200F8,?), ref: 03CD407E

EnterCriticalSection.KERNEL32(03CD84D4), ref: 03CD4F89

Part of subcall function 03CD4E27: LeaveCriticalSection.KERNEL32(03CD84D4), ref: 03CD4FA6

Strings

%s\*, xrefs: 03CD4EB7
Telegram, xrefs: 03CD4F8F
%s\%s, xrefs: 03CD4EE7

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CriticalSection$AttributesEnterFileLeave
String ID: %s\%s$%s\*$Telegram
API String ID: 4087703252-4994844
Opcode ID: 3849963155f2cac12d6aef97b91b2e813898106e4d24d92a9ae86808527e965c
Instruction ID: ef443a4a003b1f9617881a7bdd49cdca24632fe6e4b029d4c533a88236a72d20
Opcode Fuzzy Hash: 3849963155f2cac12d6aef97b91b2e813898106e4d24d92a9ae86808527e965c
Instruction Fuzzy Hash: 7EA1A329A14348A9EF10EBA0EC45BBEB375EF44710F10505AF604EF2E0FBB15E45875A

Function 00A33052 Relevance: 6.0, APIs: 4, Instructions: 32
librarysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00A3307F
CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00A330A2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A330B7
FreeLibrary.KERNEL32(?), ref: 00A330C4

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Library$CreateFreeLoadObjectSingleThreadWait
String ID:
API String ID: 2432312608-0
Opcode ID: 7c4fa9e07bc0906a82213740a15e72ae6b826020241be5b78c47f49531f86ae4
Instruction ID: 21f61543173c18f17321f0393483e02e2bae8b744ecbf30bbd3707f8504defb9
Opcode Fuzzy Hash: 7c4fa9e07bc0906a82213740a15e72ae6b826020241be5b78c47f49531f86ae4
Instruction Fuzzy Hash: 00011970A40318ABDB34CF94DC8DBAA7734FB15315F1006C9FA2A5A2A1CBB16AC1CF50

Function 03CD46D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03CD4812), ref: 03CD46E6
LoadLibraryA.KERNEL32(ntdl,?,?,?,?,?,?,?,03CD4812), ref: 03CD46F3

Strings

ntdl, xrefs: 03CD46E1, 03CD46F2

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: ntdl
API String ID: 4133054770-3973061744
Opcode ID: 203f6fad7c64d27f889ef622472837531943014125687f897d8b7e6e4172868d
Instruction ID: afa62259af03df905329db97e7903db7373d679bc678e91d53b5652aa1623f6b
Opcode Fuzzy Hash: 203f6fad7c64d27f889ef622472837531943014125687f897d8b7e6e4172868d
Instruction Fuzzy Hash: 98318039E00615DBCB18DF9AC490ABDF7F5BF46714F0A0299E611DB741CB34AA51CBA0

Function 00A7C900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00A7C9E8
task.LIBCPMTD ref: 00A7C9F6

Strings

}{cdef~hijkl/nopqrstuvwx|><B-DEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+, xrefs: 00A7C92A

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contexttask
String ID: }{cdef~hijkl/nopqrstuvwx|><B-DEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+
API String ID: 605201214-2946796713
Opcode ID: 6bd5f1ca8678bcaf6a00687a08d4c9b69fe0bf3f669f004b12755fb72c773a8a
Instruction ID: ff5a98cf765eb92d82a58c2c1ccc1c5bd7c27cc8e0ef859ce74051279d9119b5
Opcode Fuzzy Hash: 6bd5f1ca8678bcaf6a00687a08d4c9b69fe0bf3f669f004b12755fb72c773a8a
Instruction Fuzzy Hash: 8631E271D041199BCB04DF98CA92BEEBBB1FB49310F20856EE419B7280DB746A00CBA1

Function 03CD3508 Relevance: 5.0, APIs: 4, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID:
API String ID: 285244410-0
Opcode ID: e9253ed1d591889dcb1d0d1bfaf327d47076f8451ace2d0a5132a1278f9cd925
Instruction ID: 7e415908de3e71af276f5568753db635bb7b7d55db6772d5e576bf2abe4b5b99
Opcode Fuzzy Hash: e9253ed1d591889dcb1d0d1bfaf327d47076f8451ace2d0a5132a1278f9cd925
Instruction Fuzzy Hash: 1DD09E3260212067CA503BE9B80CB9BEA6CEF95561705405AF205C3198CAB49C1587A0

Function 00A8EDE2 Relevance: 4.7, APIs: 3, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__freea.LIBCMT ref: 00A8EF97

Part of subcall function 00A8AC15: HeapAlloc.KERNEL32(00000000,00000000,?,?,00A7FB1F,00000000,?,00A3322C,00000000,?,00A213A5,00000000), ref: 00A8AC47

__freea.LIBCMT ref: 00A8EFAA
__freea.LIBCMT ref: 00A8EFB7

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: __freea$AllocHeap
String ID:
API String ID: 85559729-0
Opcode ID: f27530614f3591f81dde9dbb1263d82f0c36af4e5b6062285ed7cbafb39c7e3e
Instruction ID: 7a37496b581e86a706e2895f8439eac0362a4eab275cdb46ed834c7588149e18
Opcode Fuzzy Hash: f27530614f3591f81dde9dbb1263d82f0c36af4e5b6062285ed7cbafb39c7e3e
Instruction Fuzzy Hash: 7F51907260020AEFEF21EF60DD85EBB7AA9EF94750B150129FE08D6150EB74DC50C7A1

Function 03CD536D Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 138COMMON

Download Yara Rule

Strings

146.70.169.164, xrefs: 03CD5494
ws2_32.dll, xrefs: 03CD53E8

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: 146.70.169.164$ws2_32.dll
API String ID: 4133054770-4085977579
Opcode ID: 987999cfbcf7d6671b8475fff7b20d55673a2537e80e11dd4ca558e00a7a3a98
Instruction ID: 5444d7f336be1609f9430b05104ce17193e0bb611526f0e9932935c547304437
Opcode Fuzzy Hash: 987999cfbcf7d6671b8475fff7b20d55673a2537e80e11dd4ca558e00a7a3a98
Instruction Fuzzy Hash: 5651A430C04289EEEB12DBE8D8097EDBFB89F16314F144189E660EE2C1D7B5474ACB61

Function 00A92F61 Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00A92A95: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00A92AC0

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00A92DA5,?,00000000,?,00000000,?), ref: 00A92FC2
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A92DA5,?,00000000,?,00000000,?), ref: 00A92FFE

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 57a3539df1cdfad2f2e2443bee0493be4873b087386a2011657280bc99b7b526
Instruction ID: 78536a93d3ce1fcf75dff74348e567cb3a7010b880d3c1e140bb742d68b2bcdc
Opcode Fuzzy Hash: 57a3539df1cdfad2f2e2443bee0493be4873b087386a2011657280bc99b7b526
Instruction Fuzzy Hash: 12513176B00345AEDF21CF7AC885AAFBBF4EF41300F14856ED0868B251E7759A06CB91

Function 03CD3536 Relevance: 2.5, APIs: 2, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,03CD264F), ref: 03CD353D
HeapFree.KERNEL32(00000000), ref: 03CD3544

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: a92c6f957bb92bc82229f2ea52ae7071ee54eb1a8971ebef09a9fc1a3c2172ee
Instruction ID: cfff450146e62d9b00979227b290fc94bf99ace31c0ff3a20f112ed4e0d0bcef
Opcode Fuzzy Hash: a92c6f957bb92bc82229f2ea52ae7071ee54eb1a8971ebef09a9fc1a3c2172ee
Instruction Fuzzy Hash: 32B092745021006AEE887BA0A90DB3A3618AB00603F04008CB202D50849678A9208621

Function 00A92B69 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(FFFFF9B2,?,00000005,00A92DA5,?), ref: 00A92B9B

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 2d06e90ef91500d42e2592a6a34b279d1c40ab52632996a79803961763ca5a74
Instruction ID: 0416ca37fe818351c98b47e39327c4bb53448a7156aec3a01ac10b34d08bd9ac
Opcode Fuzzy Hash: 2d06e90ef91500d42e2592a6a34b279d1c40ab52632996a79803961763ca5a74
Instruction Fuzzy Hash: B65138B1A08158BADF118F28CD84BEABBFCFB15304F1401E9E599D7182D3359D85DB60

Function 00A7FB05 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00A8037B

Part of subcall function 00A8106C: RaiseException.KERNEL32(E06D7363,00000001,00000003,00A8038E,?,?,?,?,00A8038E,?,00AA8484), ref: 00A810CC

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ExceptionRaisestdext::threads::lock_error::lock_error
String ID:
API String ID: 3447279179-0
Opcode ID: a52489d87e1c2c9fee6b703c9339338edf694ac5027479113da7a214c0fc327a
Instruction ID: e03f7ddc5117ab7bc53348fb516f674dd4cc3be26103f59c4cc036f88e3c437c
Opcode Fuzzy Hash: a52489d87e1c2c9fee6b703c9339338edf694ac5027479113da7a214c0fc327a
Instruction Fuzzy Hash: 22F0B43580030DBBCB04BAB4ED1ADAD777CAA04350F60C530B968A60D2EF34EA498295

Function 00A21460 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00A21477

Part of subcall function 00A33D80: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00A33D89

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstdext::threads::lock_error::lock_error
String ID:
API String ID: 2103942186-0
Opcode ID: 7e938961fb2e67025cdff9c0a0f1d748bbed45857ce640becdc6d9bdc5e37106
Instruction ID: a3be121e11af1886dbb2ad6fb47fbeb678018139b4a6b1d803d49b048fddd917
Opcode Fuzzy Hash: 7e938961fb2e67025cdff9c0a0f1d748bbed45857ce640becdc6d9bdc5e37106
Instruction Fuzzy Hash: D6F019B5D01108ABCB14EFA8E6816AEB7B1AF58304F10C1B9E8099B345E630AF508B81

Function 00A8E1D3 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00A8EED2,?,?,-00000008,?,00000000), ref: 00A8E225

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 0b8063070de6d5279f20e635212540f853688132dde259a9530987654f7397dc
Instruction ID: 8c05f2426ad6f56333ecd9980f74edb9b8a2826b4d7b23b77ecb478ac16c93d1
Opcode Fuzzy Hash: 0b8063070de6d5279f20e635212540f853688132dde259a9530987654f7397dc
Instruction Fuzzy Hash: 88F0683250011AFBCF12AF94DC05DDE7F2AFB48760F058515FA1826020DA32D832AB90

Function 00A57B09 Relevance: 1.5, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00000007,?,?), ref: 00A34B9E

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 24d2f882f2f73bb6acfbab9831556a5d06011cddee88d6195ce90b674ae05608
Instruction ID: f0f78f73790c81174aea2883973c769b94d63ec09e04bd5108ff8b8bdc4f0524
Opcode Fuzzy Hash: 24d2f882f2f73bb6acfbab9831556a5d06011cddee88d6195ce90b674ae05608
Instruction Fuzzy Hash: 16D012B6A2410987CB20DFACAC483A27778F705316B14118EE95847153DB3255168F50

Function 00A213B0 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00A213BC

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 571f10d42482652b194d7ecda06d937b3b08c569b6719ab49de57ad63638ba45
Instruction ID: 53bd8adc14960adb69df2955be6845f7e885d6fe758c4a0d484e91c9843b3fad
Opcode Fuzzy Hash: 571f10d42482652b194d7ecda06d937b3b08c569b6719ab49de57ad63638ba45
Instruction Fuzzy Hash: C1C09B3011410C5B8704DF88E491D55739D9B8C710B004155BC0D4B351CA30FD40C554

Function 03CD407D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(016200F8,03CD1035,016200F8,?), ref: 03CD407E

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2a79be9e7f20f5a87746e953b434d7582fb0066a856bf4533d0c1a4167f0d36a
Instruction ID: 10fa164ed4a7265a98516f86dc4453ea5c7f754839bc6f15883501659bd97098
Opcode Fuzzy Hash: 2a79be9e7f20f5a87746e953b434d7582fb0066a856bf4533d0c1a4167f0d36a
Instruction Fuzzy Hash: FFA022380302008BCA2C2B302B2A30E30000E0A2F03220B8CB033C80C0EA38CAA00000

Function 00A47EEA Relevance: 1.3, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000001,00003000,00000040), ref: 00A38B81

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e958405a7abae943b2f04a885e73f353a778afa5b8bb6bc1f6f3a8fd0204756f
Instruction ID: de171e469d9fcef813a4150f3984bd26d9c36975cf16bca5bd9bd4ed38f2f962
Opcode Fuzzy Hash: e958405a7abae943b2f04a885e73f353a778afa5b8bb6bc1f6f3a8fd0204756f
Instruction Fuzzy Hash: 7221E9B1D05A28CBDB62CF24C9817ADF7B5AF51340F1092C6E40D66202DB385BC5DF10

Function 00A8AC15 Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00000000,?,?,00A7FB1F,00000000,?,00A3322C,00000000,?,00A213A5,00000000), ref: 00A8AC47

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: f1f68d8ab443dbef5fe727756e7324d57703eeb292e4658b59b8110878ba90f9
Instruction ID: 5d2b38af12479431d61f63d0d63c2ef5ca7a9cfe9048800161577554ead69ae4
Opcode Fuzzy Hash: f1f68d8ab443dbef5fe727756e7324d57703eeb292e4658b59b8110878ba90f9
Instruction Fuzzy Hash: 5CE0E571204A1567F7313BF59D0079F3A98AF223A0F180123FC05962D0EB60CC00C3A2

Non-executed Functions

Function 00A95458 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00A9576A,00000002,00000000,?,?,?,00A9576A,?,00000000), ref: 00A954F1
GetLocaleInfoW.KERNEL32(?,20001004,00A9576A,00000002,00000000,?,?,?,00A9576A,?,00000000), ref: 00A9551A
GetACP.KERNEL32(?,?,00A9576A,?,00000000), ref: 00A9552F

Strings

ACP, xrefs: 00A95476
OCP, xrefs: 00A954AC

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 8e3d0ee21c687e95a4b37a15e9c732cd6acc9c9b5798508490e2051368c464a7
Instruction ID: 8f849b32c1c92c7223050f91694ce8ea67f3683e6cf2ae0633a013699ed47ed7
Opcode Fuzzy Hash: 8e3d0ee21c687e95a4b37a15e9c732cd6acc9c9b5798508490e2051368c464a7
Instruction Fuzzy Hash: 2521A172F00901AADF728F74D907A9773F7AB90B61B668465E90AC7105FB32EE81C750

Function 00A95634 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00A9573C
IsValidCodePage.KERNEL32(00000000), ref: 00A9577A
IsValidLocale.KERNEL32(?,00000001), ref: 00A9578D
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00A957D5
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00A957F0

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 58b5b22ba4400b8f10b2307c302b5a9c1d7e881f862242c4b8e632d9061f1b2f
Instruction ID: 99703d0aff977c77b3555e66ff26c2e5dece390b10edbd6a0569bd36d1d88499
Opcode Fuzzy Hash: 58b5b22ba4400b8f10b2307c302b5a9c1d7e881f862242c4b8e632d9061f1b2f
Instruction Fuzzy Hash: FA516071F10A09ABEF12DFB4CD86AAE77F8BF48700F544429E914E7191EB709A418B61

Function 00A94CBF Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 254COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

GetACP.KERNEL32(?,?,?,?,?,?,00A889B1,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00A94D7E
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00A889B1,?,?,?,00000055,?,-00000050,?,?), ref: 00A94DB5
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00A94F18

Strings

utf8, xrefs: 00A94E87

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 70d1ff613ef3f878a1579fd59e84518477e7129b6c5526b2248c1fd7a46fff11
Instruction ID: 0390b2ecee7bca4fc92cc9419262dd3655f4b4afbf8103401cb64378492ee487
Opcode Fuzzy Hash: 70d1ff613ef3f878a1579fd59e84518477e7129b6c5526b2248c1fd7a46fff11
Instruction Fuzzy Hash: CB71EF35B00206AAEF25AB75DD42FAB73E8EF49704F11042AFA15DB181EA74ED428761

Function 00A80495 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00A804A1
IsDebuggerPresent.KERNEL32 ref: 00A8056D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A80586
UnhandledExceptionFilter.KERNEL32(?), ref: 00A80590

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 761c1b1d5993146cf1ba1f459ef2863d865372ed4ccc8ce06285a86df5f6fd33
Instruction ID: ab029372d9bcce5091fa340721fdf0045138f784adb30e39e71b2a37da3cd1d7
Opcode Fuzzy Hash: 761c1b1d5993146cf1ba1f459ef2863d865372ed4ccc8ce06285a86df5f6fd33
Instruction Fuzzy Hash: 8B31EA75D01218DBDF61EFA4DD49BCEBBB8AF08300F1041AAE50DAB250EB719A85CF45

Function 00A950DC Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A95130
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A9517A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A95240

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 40e5050f095480dabb88cda5b0f5a132d06486a1a39b643352169d749e3634e0
Instruction ID: c6d0efbfccfa60f2dd707d8b917810614360d976cdd3f31f460f13bb71431f31
Opcode Fuzzy Hash: 40e5050f095480dabb88cda5b0f5a132d06486a1a39b643352169d749e3634e0
Instruction Fuzzy Hash: A6618E71E106179BEF2A9F38CD83BAA77E8EF14340F20416AE905CA185F774D991CB50

Function 00A84383 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00A8447B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00A84485
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00A84492

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0ebce31baf82477e2abb4dc2025c987639326acbd8890d307334c841d9b781f6
Instruction ID: e15a73a05bab8900d1351e7f2c7b8b0aaf98084aff58caec90cc248d50afc61e
Opcode Fuzzy Hash: 0ebce31baf82477e2abb4dc2025c987639326acbd8890d307334c841d9b781f6
Instruction Fuzzy Hash: 9631C475901319ABCB61EF68DD89B8DBBB8BF18311F5041EAE41CA6250EB709B858F44

Function 00A8013C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00A80152

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: b486cc25d2173e878e22178fa24f9a7cae08efbd85a90194608fe553fb53d902
Instruction ID: 2ccf5bdcd106e7aba58ca1d9d7a4427322bea1b041f629e57998668ce38d93dc
Opcode Fuzzy Hash: b486cc25d2173e878e22178fa24f9a7cae08efbd85a90194608fe553fb53d902
Instruction Fuzzy Hash: 1D519FB1E11206CFEB55CFA4D885BAEBBF4FB48310F24812AD505EB292E3759D45CB60

Function 00A9532F Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00A95383

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 5c9075957b75337c5bfba8348779715564690a5019568f989f3eb3f48964d786
Instruction ID: 744f613ee6a19ad23e8d0e3ce186d2af99d01a46196f6eb54aa0989205d22be5
Opcode Fuzzy Hash: 5c9075957b75337c5bfba8348779715564690a5019568f989f3eb3f48964d786
Instruction Fuzzy Hash: D021B032B10606ABEF29AB25DD52ABB33F8EF44350B10407AF901CA141EBB8ED45CB50

Function 00A94FB6 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

EnumSystemLocalesW.KERNEL32(00A950DC,00000001,00000000,?,-00000050,?,00A95710,00000000,?,?,?,00000055,?), ref: 00A95028

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 568ea0525c16907904224ce7fa4635b049b3f2abc1f8aac9de06dee86a03cd9a
Instruction ID: 37449d100e089721f02bc477bb9f04e4afef55ddd6af05c8f10d02b4320393e4
Opcode Fuzzy Hash: 568ea0525c16907904224ce7fa4635b049b3f2abc1f8aac9de06dee86a03cd9a
Instruction Fuzzy Hash: CD1129377007059FDF189F39C89157ABBD1FF84358B14442DE94647640D7716843C740

Function 00A9555E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00A952F8,00000000,00000000,?), ref: 00A9558A

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ff66c527546e4b491b73baa6ff343d17ff0ac00a06601fea71dcc45451071b94
Instruction ID: 36300ee6d07c62d8d23079f33b316ff5f770959d3da544bfb2cf78632d36121c
Opcode Fuzzy Hash: ff66c527546e4b491b73baa6ff343d17ff0ac00a06601fea71dcc45451071b94
Instruction Fuzzy Hash: 6301A232B00612ABDF299B34C806ABB37E5EB41754F164429EC06A3181EA24FE41C790

Function 00A95051 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

EnumSystemLocalesW.KERNEL32(00A9532F,00000001,00000000,?,-00000050,?,00A956D8,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00A9509B

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 417506e1e2e1fda66d0e459e154c0cd812f8ed2abba94c2f16bb5e19a60ce77f
Instruction ID: f793f22fd40149e01f273a6716df7d4ead9911a27d5debc0c1937a2dba8a4760
Opcode Fuzzy Hash: 417506e1e2e1fda66d0e459e154c0cd812f8ed2abba94c2f16bb5e19a60ce77f
Instruction Fuzzy Hash: B9F0F636700B046FDF256F399892A7B7BE1EF80368F05442DF9464B680D6B19C42C790

Function 00A8DBC7 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A849CA: EnterCriticalSection.KERNEL32(-00AAB8A8,?,00A876D7,00000000,00AA8C40,0000000C,00A8769F,?,?,00A8DB90,?,?,00A8AA8E,00000001,00000364,00000000), ref: 00A849D9

EnumSystemLocalesW.KERNEL32(00A8DBBA,00000001,00AA8E30,0000000C,00A8DF92,00000000), ref: 00A8DBFF

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 4ef9449880b418c9c9c2704ef7607c27aa4735c63e6e41fee119dc864fbf075e
Instruction ID: ab4904efd5c27410c2285e604e3e4ea27f8b80eb1fb5bae59632f3e1efafe28a
Opcode Fuzzy Hash: 4ef9449880b418c9c9c2704ef7607c27aa4735c63e6e41fee119dc864fbf075e
Instruction Fuzzy Hash: 16F04972A10305EFD710EF98E902B9EB7F0FB09720F10412AF4149B2E1DBB99901CB50

Function 00A94F6B Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00A8A8F0: GetLastError.KERNEL32(?,?,00A871B7,?,?,?,?,00000003,00A84382,?,00A842F1,?,00000000,00A84500), ref: 00A8A8F4
Part of subcall function 00A8A8F0: SetLastError.KERNEL32(00000000,00000000,00A84500,?,?,?,?,?,00000000,?,?,00A8459E,00000000,00000000,00000000,00000000), ref: 00A8A996

EnumSystemLocalesW.KERNEL32(00A94EC4,00000001,00000000,?,?,00A95732,-00000050,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00A94FA2

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e3f105cffc3aaf5ac904fd73a3b5d422700897bf61c4ed543bf8c52fbb264c2e
Instruction ID: 059f38931d698f0078ec9f78efdd088af70d51c0d972aa7de1e297dc39a6890b
Opcode Fuzzy Hash: e3f105cffc3aaf5ac904fd73a3b5d422700897bf61c4ed543bf8c52fbb264c2e
Instruction Fuzzy Hash: 5FF0E5367002466BCF14EF39D845A6ABFE4FFC5B10F064059EE098B691C6759883C7A0

Function 00A8E096 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00A89527,?,20001004,00000000,00000002,?,?,00A88B19), ref: 00A8E0CA

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 220ee1ccbb7815f8b322ae3906f7fd4f826caebe161916a22c9f35d0300c65fe
Instruction ID: 278f8d747aa32b998ff62de8c9d55a716b9ed7e298cd15ed1ec368e5466eb7e2
Opcode Fuzzy Hash: 220ee1ccbb7815f8b322ae3906f7fd4f826caebe161916a22c9f35d0300c65fe
Instruction Fuzzy Hash: FBE01A31640228BBCF12BFA5DD04BAE3F2ABB44760F144415FC09662618B719921EB95

Function 00A80622 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0006062E,00A7FC56), ref: 00A80627

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 49fb2bc1f2d394b095aff5ce14f1716ef29e85bffa3809c99f7e20991ec05fe6
Instruction ID: d7709e2513c2f694629af859db03ec9a2ee731b34bf24a3fe54072e0b863a089
Opcode Fuzzy Hash: 49fb2bc1f2d394b095aff5ce14f1716ef29e85bffa3809c99f7e20991ec05fe6
Instruction Fuzzy Hash:

Function 00A95891 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00A95891

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8132c457bfeda6302c13e3631631f5bf37e8e3f0172011f4be22e1ad4d7c19bc
Instruction ID: 9148a64033259354004bd09ba542542540fd664fe8cf855ebaea25f829f53785
Opcode Fuzzy Hash: 8132c457bfeda6302c13e3631631f5bf37e8e3f0172011f4be22e1ad4d7c19bc
Instruction Fuzzy Hash: AEA00270611106DF5740CF755F0920D36E97545591B1541595405C5171DF2584519A11

Function 03CD42EC Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQuerySystemInformation,?,00000000,?,?,?,?,?,03CD4574), ref: 03CD4305
GetProcAddress.KERNEL32(00000000,?,?,?,?,03CD4574), ref: 03CD430E
GetModuleHandleA.KERNEL32(ntdll,NtQueryObject,?,?,?,?,03CD4574), ref: 03CD431F
GetProcAddress.KERNEL32(00000000,?,?,?,?,03CD4574), ref: 03CD4322

Part of subcall function 03CD3508: EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
Part of subcall function 03CD3508: GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
Part of subcall function 03CD3508: HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
Part of subcall function 03CD3508: LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

OpenProcess.KERNEL32(00000040,00000000,00000000,?,?,?,?,03CD4574), ref: 03CD43A4
GetCurrentProcess.KERNEL32(03CD4574,00000000,00000000,00000002,?,?,?,?,03CD4574), ref: 03CD43C0
DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,03CD4574), ref: 03CD43CF
CloseHandle.KERNEL32(03CD4574,?,?,?,?,03CD4574), ref: 03CD43FF
GetCurrentProcess.KERNEL32(03CD4574,00000000,00000000,00000001,?,?,?,?,03CD4574), ref: 03CD440D
DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,03CD4574), ref: 03CD441C
CloseHandle.KERNEL32(?,?,?,?,?,03CD4574), ref: 03CD442F
CloseHandle.KERNEL32(000000FF), ref: 03CD4452
CloseHandle.KERNEL32(?), ref: 03CD445A

Strings

NtQueryObject, xrefs: 03CD4310
ntdll, xrefs: 03CD4300, 03CD4317
NtQuerySystemInformation, xrefs: 03CD42FB

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: Handle$CloseProcess$AddressCriticalCurrentDuplicateHeapModuleProcSection$AllocEnterLeaveOpen
String ID: NtQueryObject$NtQuerySystemInformation$ntdll
API String ID: 4050662462-2044536123
Opcode ID: d4ac80ca37916998a1267ff74df3e7119af763aae9e8822b9a5a2b3785e18809
Instruction ID: 2f64d01780cfeaf4f02b2fba161e8da330bc1ac0b4e7131f21a1ba0541bcdd39
Opcode Fuzzy Hash: d4ac80ca37916998a1267ff74df3e7119af763aae9e8822b9a5a2b3785e18809
Instruction Fuzzy Hash: 46419071A00219ABDB14EFE69C84AAFBBB9EF44610F194065FB14E7190DB70DE50DBA0

Function 00A23930 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A23959
_Yarn.LIBCPMTD ref: 00A2396B
_Yarn.LIBCPMTD ref: 00A2397A
_Yarn.LIBCPMTD ref: 00A23989
_Yarn.LIBCPMTD ref: 00A23998
_Yarn.LIBCPMTD ref: 00A239A7
_Yarn.LIBCPMTD ref: 00A239B6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00A239CD

Part of subcall function 00A7CF3B: _Yarn.LIBCPMT ref: 00A7CF5A
Part of subcall function 00A7CF3B: _Yarn.LIBCPMT ref: 00A7CF7E

Strings

bad locale name, xrefs: 00A239D7

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: 13e2af16e7dccf597956c62a49910896a5b60d3ce30bbc63f5532ffa34b73da1
Instruction ID: 94ae57ab1efcd7a7ad183afe1fd176de2122a90ae63e936e1f5b988d64277c98
Opcode Fuzzy Hash: 13e2af16e7dccf597956c62a49910896a5b60d3ce30bbc63f5532ffa34b73da1
Instruction Fuzzy Hash: 672190B0904259EBCF08EB9CDE51BBEBB70BF45308F14856CE4122B782CB755A10CB62

Function 03CD2991 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 03CD2A7C

Strings

(null), xrefs: 03CD2B87
0123456789abcdef, xrefs: 03CD29F1
0123456789ABCDEF, xrefs: 03CD29F8
(null), xrefs: 03CD2B0D

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: (null)$(null)$0123456789ABCDEF$0123456789abcdef
API String ID: 1302938615-1267642376
Opcode ID: e4281c8d3e67355536038f440597d2f5873e15b5057488eaf7f0d35c9fc69c16
Instruction ID: a7b954af62fb77518a9871939575e333e49f41472f4e645c662b5f7560ae9f7f
Opcode Fuzzy Hash: e4281c8d3e67355536038f440597d2f5873e15b5057488eaf7f0d35c9fc69c16
Instruction Fuzzy Hash: 31917C706047029FDB25CF29C48062AFBE5EF85244F184D6EF6DACB651DBB0EA81CB51

Function 00A832E1 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00A83400
___TypeMatch.LIBVCRUNTIME ref: 00A8350E
_UnwindNestedFrames.LIBCMT ref: 00A83660
CallUnexpected.LIBVCRUNTIME ref: 00A8367B

Strings

csm, xrefs: 00A8338B
csm, xrefs: 00A83437
csm, xrefs: 00A8331E

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d4e16f05b65ea6c880a657a36ad6d991202bf812c5095d5ca0b11f67f1a55ef6
Instruction ID: 146e9604f63adc59fe39be8fd8929727295cbc84509c2634f24fbcac032efee8
Opcode Fuzzy Hash: d4e16f05b65ea6c880a657a36ad6d991202bf812c5095d5ca0b11f67f1a55ef6
Instruction Fuzzy Hash: 86B15A72800209EFCF19EFA8C9819AEBBB5FF18B10B144569E8116B212D731DF61CF91

Function 00A91338 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00A915B2, 00A915B7

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: bfd52b0cc1316a9ce92a93469f90be3cb580d30a1f6550480f8c1c8ea363f060
Instruction ID: 77a1f6d983862c589bb88dde33d3df22fc88753f20959f77d553f34d61f21389
Opcode Fuzzy Hash: bfd52b0cc1316a9ce92a93469f90be3cb580d30a1f6550480f8c1c8ea363f060
Instruction Fuzzy Hash: 41B1F370F0424AAFDF11EFA9C991BAE7FF5AF89350F194158E5019B292C7709D42CB60

Function 03CD1F2D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32 ref: 03CD1F90
GetKeyboardLayoutList.USER32(00000032,?), ref: 03CD1FF2

Strings

- KeyboardLayouts: ( , xrefs: 03CD1FDB
), xrefs: 03CD2042
{%d} , xrefs: 03CD2025
- SystemLayout %d, xrefs: 03CD1FCC

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: DefaultKeyboardLanguageLayoutListUser
String ID: )$- KeyboardLayouts: ( $- SystemLayout %d${%d}
API String ID: 167087913-619012376
Opcode ID: 8898c77d4180dba594cf5c5165556ee464d53ffcc304f9f7c77091f463e9819c
Instruction ID: 529360e2f4899b07fd3496d42173a327cc7700462e02ee01ca9f7d27940ffa74
Opcode Fuzzy Hash: 8898c77d4180dba594cf5c5165556ee464d53ffcc304f9f7c77091f463e9819c
Instruction Fuzzy Hash: F831B164E08298AADB419FE4A4017FDBB70AF14305F00549AF688FA282E7794B45D76A

Function 00A8DD94 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,B35EB3F9,?,00A8DEA3,00000000,00A213A5,00000000,00000000), ref: 00A8DE55

Strings

api-ms-, xrefs: 00A8DDEB
ext-ms-, xrefs: 00A8DDFF

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 48804968997ddd21206a0bbac05e93ddbadb21f1f07f249cada8bc38a602bdab
Instruction ID: 57fed907c6574ef888897fd2e4c92fe1118191f2d94ae8c129c7cbfb98ffa8f7
Opcode Fuzzy Hash: 48804968997ddd21206a0bbac05e93ddbadb21f1f07f249cada8bc38a602bdab
Instruction Fuzzy Hash: 1621E432B01211BBDB21FBA4DC45AAB3769EB527A0F240115F916AF2D1DB30ED01C7E0

Function 00A7E516 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A7E51D
std::_Lockit::_Lockit.LIBCPMT ref: 00A7E527
int.LIBCPMTD ref: 00A7E53E

Part of subcall function 00A246D0: std::_Lockit::_Lockit.LIBCPMT ref: 00A246E6
Part of subcall function 00A246D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00A24710

codecvt.LIBCPMT ref: 00A7E561
std::_Facet_Register.LIBCPMT ref: 00A7E578
std::_Lockit::~_Lockit.LIBCPMT ref: 00A7E598
Concurrency::cancel_current_task.LIBCPMTD ref: 00A7E5A5

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: f087e5b103552ce373ce13a28519a399b71798695b35fb5b07929ad9e5c2bd0b
Instruction ID: 6ff426dd97050bae674c3f85f5c589bc6b997afb025d16e194362c67b9c8d248
Opcode Fuzzy Hash: f087e5b103552ce373ce13a28519a399b71798695b35fb5b07929ad9e5c2bd0b
Instruction Fuzzy Hash: 7611E472A102199FCB10EBA8DD467AE77B5BF88320F10850DF4099B281EFB49E018B90

Function 00A7D7A8 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A7D7AF
std::_Lockit::_Lockit.LIBCPMT ref: 00A7D7B9
int.LIBCPMTD ref: 00A7D7D0

Part of subcall function 00A246D0: std::_Lockit::_Lockit.LIBCPMT ref: 00A246E6
Part of subcall function 00A246D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00A24710

codecvt.LIBCPMT ref: 00A7D7F3
std::_Facet_Register.LIBCPMT ref: 00A7D80A
std::_Lockit::~_Lockit.LIBCPMT ref: 00A7D82A
Concurrency::cancel_current_task.LIBCPMTD ref: 00A7D837

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 1f2cae09f6cae387f4a3c7c5a415a3487e0f491656ac1815ec272bc789c2819e
Instruction ID: d2af82807a43eeda4337e703b1766f85a2190a622901e9ef7b5c18a0812098a1
Opcode Fuzzy Hash: 1f2cae09f6cae387f4a3c7c5a415a3487e0f491656ac1815ec272bc789c2819e
Instruction Fuzzy Hash: DB01C4759001169BCB04EBA4DE41AAE7771BF84320F24810DF4156B291CF789A05C7D1

Function 00A7F8DE Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00A7F927
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00A7F992
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A7F9AF
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00A7F9EE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00A7FA4D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00A7FA70

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 1b4e842e60adcc3e9931b3b71e746cc83688c0de1dff6abb492bd8169ddc6d2d
Instruction ID: a1ee04555f53f000da52357eb070350752b99a25c47ab0745859c03d0a66c87b
Opcode Fuzzy Hash: 1b4e842e60adcc3e9931b3b71e746cc83688c0de1dff6abb492bd8169ddc6d2d
Instruction Fuzzy Hash: 35517B72A0020ABFEF219FA4CC45FAB7BB9EB44790F14C529F91DA6150DB748A11CB60

Function 03CD3084 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

x, xrefs: 03CD33C4

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: 0f5c6de11b95a8a74b7e562c3f64d376e0fbb4b5d7f39440b7c323e9dba4ef53
Instruction ID: 1fd15ba1b90b4ff0cf58d797a643994460ed9cf4a086800f40b4abcec225a7ae
Opcode Fuzzy Hash: 0f5c6de11b95a8a74b7e562c3f64d376e0fbb4b5d7f39440b7c323e9dba4ef53
Instruction Fuzzy Hash: 8A02B078E00289EFCB41DF99D984AADBBF4FF09304F048456E966EB250D774AA11CF52

Function 00A82FAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00A82FA1,00A816DC,00A80672), ref: 00A82FB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A82FC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A82FDF
SetLastError.KERNEL32(00000000,00A82FA1,00A816DC,00A80672), ref: 00A83031

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: da32ba3dd1cef52abc480460fb95b943bf2d6eaa146e9002595538c9378ec44c
Instruction ID: 3859a8f09e7658838b21ac632e59465aea121531ca1b51f99ceff16c4988f027
Opcode Fuzzy Hash: da32ba3dd1cef52abc480460fb95b943bf2d6eaa146e9002595538c9378ec44c
Instruction Fuzzy Hash: 8901D8332093236DBF257BF87E8572B26A5EB66B70720432AF210550E0EF514C11D341

Function 00A880CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B35EB3F9,?,?,00000000,00A98AEC,000000FF,?,00A880A8,?,?,00A8807C,00000000), ref: 00A88101
GetProcAddress.KERNEL32(00000000,CorExitProcess,?,00000000,00A98AEC,000000FF,?,00A880A8,?,?,00A8807C,00000000), ref: 00A88113
FreeLibrary.KERNEL32(00000000,?,00000000,00A98AEC,000000FF,?,00A880A8,?,?,00A8807C,00000000), ref: 00A88135

Strings

mscoree.dll, xrefs: 00A880FA
CorExitProcess, xrefs: 00A8810B

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 807c19dc97ee108cdf2dba2740ece188790d39f9382801ad452ef95b9fbd858f
Instruction ID: e20e1f1de7e63c768568e39832ccf90bc9d81ae678e458a457689f5668d615b9
Opcode Fuzzy Hash: 807c19dc97ee108cdf2dba2740ece188790d39f9382801ad452ef95b9fbd858f
Instruction Fuzzy Hash: 0C014471610525FBDB11DB95DC09BAFBBB9FB09711F00062AE811A2290DF799901CB60

Function 00A21E20 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A21E40
int.LIBCPMTD ref: 00A21E59

Part of subcall function 00A246D0: std::_Lockit::_Lockit.LIBCPMT ref: 00A246E6
Part of subcall function 00A246D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00A24710

Concurrency::cancel_current_task.LIBCPMTD ref: 00A21E99
std::_Lockit::~_Lockit.LIBCPMT ref: 00A21F01

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 5924a87a05ef14222392b21529ac8722ea295dcb817fcf668941a12e52c00fec
Instruction ID: 0684f89f9ce9da0458614a01ce82e08ec9ba080f06dba04fa579681a96c65157
Opcode Fuzzy Hash: 5924a87a05ef14222392b21529ac8722ea295dcb817fcf668941a12e52c00fec
Instruction Fuzzy Hash: 37311EB5D00259DFCB04DF98D991BFEBBB0BF58310F208629E91567391DB345A44CBA1

Function 00A21F20 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00A21F40
int.LIBCPMTD ref: 00A21F59

Part of subcall function 00A246D0: std::_Lockit::_Lockit.LIBCPMT ref: 00A246E6
Part of subcall function 00A246D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00A24710

Concurrency::cancel_current_task.LIBCPMTD ref: 00A21F99
std::_Lockit::~_Lockit.LIBCPMT ref: 00A22001

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: f6cebbbb08a938848ac92a800077caf415d48f72c5e91f4ff0fdfb8080f41bc3
Instruction ID: 3f7843e57a0df8c91ad25ba5b82f11de839cfdf559ac5d44e5bea17341533d9b
Opcode Fuzzy Hash: f6cebbbb08a938848ac92a800077caf415d48f72c5e91f4ff0fdfb8080f41bc3
Instruction Fuzzy Hash: 0C314FB1D04219DFCB04DF98DA81BEEB7B0BF58310F208629E425673D1DB345A44CBA1

Function 00A7CE3D Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00A7CE44
std::_Lockit::_Lockit.LIBCPMT ref: 00A7CE4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00A7CEBD

Part of subcall function 00A7CFA0: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00A7CFB8

std::locale::_Setgloballocale.LIBCPMT ref: 00A7CE6A
_Yarn.LIBCPMT ref: 00A7CE80

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: f26e8b565f3b19de687e979d4ff15d69df9518b0acf74da2f3a5330451a78000
Instruction ID: 5970907fb24472d3279e49cb889e01d4d0ac65471f1aa76bd494306b64b4ec2a
Opcode Fuzzy Hash: f26e8b565f3b19de687e979d4ff15d69df9518b0acf74da2f3a5330451a78000
Instruction Fuzzy Hash: 3F01FC76A002119BCB06EB60DD5597E3BA2FF89320B14800DE80607382CF786E06CBC0

Function 00A84072 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A84023,00000000,?,00AAB824,?,?,?,00A841C6,00000004,InitializeCriticalSectionEx,00A9B270,InitializeCriticalSectionEx), ref: 00A8407F
GetLastError.KERNEL32(?,00A84023,00000000,?,00AAB824,?,?,?,00A841C6,00000004,InitializeCriticalSectionEx,00A9B270,InitializeCriticalSectionEx,00000000,?,00A83F7D), ref: 00A84089
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A840B1

Strings

api-ms-, xrefs: 00A84096

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: da2f4eeca3e0dd41ac33353cdca4f55f10c6652310652ef48acb230b8c4baed9
Instruction ID: 3792fe25860dfd60ccc670794df0918791900ac1e27b71fce102742bc22a3295
Opcode Fuzzy Hash: da2f4eeca3e0dd41ac33353cdca4f55f10c6652310652ef48acb230b8c4baed9
Instruction Fuzzy Hash: 4DE04830780205BBEF203BA1ED06B9A3BA49B10B54F104025FE0CE84E1DB66D8519AD5

Function 00A8F497 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B35EB3F9,00000000,00000000,00000000), ref: 00A8F4FA

Part of subcall function 00A91EBD: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A8EF8D,?,00000000,-00000008), ref: 00A91F1E

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A8F74C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A8F792
GetLastError.KERNEL32 ref: 00A8F835

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 5a64e439c09c6a9a42bab02ebd0ce05548bd00e8f0786cf0c4c4a4c81414e580
Instruction ID: 2c2b0ceeb8883ce957864a544dbd8e4fe8e1583ec1763abb8ebda2fb872f0057
Opcode Fuzzy Hash: 5a64e439c09c6a9a42bab02ebd0ce05548bd00e8f0786cf0c4c4a4c81414e580
Instruction Fuzzy Hash: 56D17C75D0024A9FDF15DFE8D8809ADBBB5FF09310F24452AE866EB255E730A942CB60

Function 00A8308A Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00A83151
___AdjustPointer.LIBCMT ref: 00A83174
___AdjustPointer.LIBCMT ref: 00A83210

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 33af9271c7d27f3cb1b0e6d0046ef9bfc2ee0330f97955297133b34163ee8e54
Instruction ID: 9e7652e90fedcb52321722a533b0fb24806fe2ed05517e84abe5daec485ebf89
Opcode Fuzzy Hash: 33af9271c7d27f3cb1b0e6d0046ef9bfc2ee0330f97955297133b34163ee8e54
Instruction Fuzzy Hash: 2D51D173604206AFDF28AF14C949BAAB7B5FF40F00F144629EC4647291E771EE82C790

Function 00A9227A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00A91EBD: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A8EF8D,?,00000000,-00000008), ref: 00A91F1E

GetLastError.KERNEL32 ref: 00A922DE
__dosmaperr.LIBCMT ref: 00A922E5
GetLastError.KERNEL32(?,?,?,?), ref: 00A9231F
__dosmaperr.LIBCMT ref: 00A92326

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 2a4ab2433af0f80c5a4f069b23e995017e49d9398589ac3e94577375b75d19ef
Instruction ID: 9dcf4d81527dbba0ad852be724d82a2ca64f46384a16ec0f11be076fa6fea954
Opcode Fuzzy Hash: 2a4ab2433af0f80c5a4f069b23e995017e49d9398589ac3e94577375b75d19ef
Instruction Fuzzy Hash: DB21D431700605BFDF24AF758981A6BBBF9FF443647108919F819CB641DB75ED018BA0

Function 00A87478 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ec4d91c41f6178449ea965137c490fbe2d2bfe987151c8f8fe2f491a1f863e
Instruction ID: bdedc37cb99f24d8e723dc7afb886f314a68a5abe6ec94c7ff45731f8264d561
Opcode Fuzzy Hash: 91ec4d91c41f6178449ea965137c490fbe2d2bfe987151c8f8fe2f491a1f863e
Instruction Fuzzy Hash: 4E21C371608605AFDB28FF75DD4092FBBA9EF413647308519F815CB150EB71ED1087A0

Function 00A9321E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00A93226

Part of subcall function 00A91EBD: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A8EF8D,?,00000000,-00000008), ref: 00A91F1E

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A9325E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A9327E

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 497243bce212f9753e023d8910a708d7c2364aed100b26557750a31dd5bb6576
Instruction ID: e482504812d9c8b6e16c97341794653a30efd8ed0249debb80d3ae7ed37c0163
Opcode Fuzzy Hash: 497243bce212f9753e023d8910a708d7c2364aed100b26557750a31dd5bb6576
Instruction Fuzzy Hash: 3111A1B27015167F7E1137B65DCECBF29FDEEA93A4720052AF802D1100EF248E018271

Function 00A97C3B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00A96B6B,00000000,00000001,0000000C,00000000,?,00A8F889,00000000,00000000,00000000), ref: 00A97C52
GetLastError.KERNEL32(?,00A96B6B,00000000,00000001,0000000C,00000000,?,00A8F889,00000000,00000000,00000000,00000000,00000000,?,00A8FE2C,?), ref: 00A97C5E

Part of subcall function 00A97C24: CloseHandle.KERNEL32(FFFFFFFE,00A97C6E,?,00A96B6B,00000000,00000001,0000000C,00000000,?,00A8F889,00000000,00000000,00000000,00000000,00000000), ref: 00A97C34

___initconout.LIBCMT ref: 00A97C6E

Part of subcall function 00A97BE6: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A97C15,00A96B58,00000000,?,00A8F889,00000000,00000000,00000000,00000000), ref: 00A97BF9

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00A96B6B,00000000,00000001,0000000C,00000000,?,00A8F889,00000000,00000000,00000000,00000000), ref: 00A97C83

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 9c0df70c7baaeb377722435ad43636b33cdb95003aa7f0cfd0d17cc15bd5cc1e
Instruction ID: 865a9ea4a1104867890e5cb87ce0e0d97ec64ce1579d1e7969b27f6a66e31013
Opcode Fuzzy Hash: 9c0df70c7baaeb377722435ad43636b33cdb95003aa7f0cfd0d17cc15bd5cc1e
Instruction Fuzzy Hash: 36F01C36614115BBCF625FD9DC099CE3FA6FB093A0F154055FA1985120DB328821DBA1

Function 03CD2C08 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 389COMMON

Download Yara Rule

APIs

Part of subcall function 03CD3508: EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
Part of subcall function 03CD3508: GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
Part of subcall function 03CD3508: HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
Part of subcall function 03CD3508: LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000005,00000000,00000000), ref: 03CD2E3D

Strings

x, xrefs: 03CD2F32

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocByteCharEnterLeaveMultiProcessWide
String ID: x
API String ID: 2065145328-2363233923
Opcode ID: 7976af8d358e106f7b7d8d3ffcad75bca0906de4c98449d5354952e8371ccf32
Instruction ID: 1a6fb82b84e37a83d982799874ff44bbce03affb6cf3d4aff0c95eb54cda3203
Opcode Fuzzy Hash: 7976af8d358e106f7b7d8d3ffcad75bca0906de4c98449d5354952e8371ccf32
Instruction Fuzzy Hash: 2802AE74904259EFCF05CF98D984AAEBBF0FF09310F148899F965EB254D734AA81CB51

Function 00A8BBFD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00A8BC8D

Strings

pow, xrefs: 00A8BC65, 00A8BC82

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: f4e182148c7e70ec67ed1300631a04a859934b1cca0763c04767d845818b1ae2
Instruction ID: d635b52ec32bc91efcd4341e4072725af6eedafd9bdbecd9c83cbb0ffc054579
Opcode Fuzzy Hash: f4e182148c7e70ec67ed1300631a04a859934b1cca0763c04767d845818b1ae2
Instruction Fuzzy Hash: 2B517DF1A24501D6CB11BB14DE4137E3BA0DB44B60F244D6AF486822E9EF358CD59F75

Function 00A82DB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00A82DEF
__IsNonwritableInCurrentImage.LIBCMT ref: 00A82EA3

Strings

csm, xrefs: 00A82E8D

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 80ece89d1106a1787c6dc6726295ac933af392d786325fc0b569c8e2b2c4a0c1
Instruction ID: ea7cac72f0df850b5aefa511864a97c2ec6b3b23fc9d8a525f9839f956e13ce1
Opcode Fuzzy Hash: 80ece89d1106a1787c6dc6726295ac933af392d786325fc0b569c8e2b2c4a0c1
Instruction Fuzzy Hash: E841A130A00209AFCF10EFA8C885BAEBFF5BF45714F148155E914AB392D7359E16CB95

Function 00A83686 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00A836AB

Strings

RCC, xrefs: 00A836C5
MOC, xrefs: 00A836BD

Memory Dump Source

Source File: 00000009.00000002.2832876060.0000000000A21000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00A20000, based on PE: true

Associated: 00000009.00000002.2832721509.0000000000A20000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833158937.0000000000A99000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833227365.0000000000AAA000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833280609.0000000000AAB000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2833310084.0000000000AAC000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a20000_1B6E.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: a5ec94ab853041b9994341c47b9cb821d73834785144cd74ae05301534f1c4c3
Instruction ID: 4c96ba34a3933c274422aa725f44b0b6cacda65d88b37c9d81dd90f7a0465ef3
Opcode Fuzzy Hash: a5ec94ab853041b9994341c47b9cb821d73834785144cd74ae05301534f1c4c3
Instruction Fuzzy Hash: A6417CB2900209AFDF15EF98CD81AEEBBB5FF48700F144599FA0567221D335EA50DB50

Function 03CD3D1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,$d.log,000000FF,00000000,00000000,00000000,00000000,?,?,?,03CD3DC1,00000000,?,0000011C), ref: 03CD3D34

Part of subcall function 03CD3508: EnterCriticalSection.KERNEL32(03CD84D4,?,?,03CD3BE5,?,03CD2251), ref: 03CD3512
Part of subcall function 03CD3508: GetProcessHeap.KERNEL32(00000008,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD351B
Part of subcall function 03CD3508: HeapAlloc.KERNEL32(00000000,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD3522
Part of subcall function 03CD3508: LeaveCriticalSection.KERNEL32(03CD84D4,?,?,?,03CD3BE5,?,03CD2251), ref: 03CD352B

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,$d.log,000000FF,00000000,?,00000000,00000000,?,03CD3DC1,00000000,?,0000011C), ref: 03CD3D6A

Strings

$d.log, xrefs: 03CD3D2B, 03CD3D63

Memory Dump Source

Source File: 00000009.00000002.2840578452.0000000003CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 03CD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3cd0000_1B6E.jbxd

Yara matches

Similarity

API ID: ByteCharCriticalHeapMultiSectionWide$AllocEnterLeaveProcess
String ID: $d.log
API String ID: 1918158005-1910398676
Opcode ID: 019b65bbb9e9d9a1da73c5d0b6b82510a41db203c4ee29963f905c6ff923373f
Instruction ID: 9fef5df7df650f891e08728f54f2c063571e6a13d78abaf7687e10cc210e50b3
Opcode Fuzzy Hash: 019b65bbb9e9d9a1da73c5d0b6b82510a41db203c4ee29963f905c6ff923373f
Instruction Fuzzy Hash: 0CF082B56011617F6724AA6ADC19C777EACDBC2B713054229FD19DF2D4DA209C0086B1

Analysis Process: setup.exePID: 5236, Parent PID: 7772COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1368
Total number of Limit Nodes:	27

Executed Functions

Function 004034CC Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 417
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004034EF
GetVersionExA.KERNEL32(?), ref: 00403518
GetVersionExA.KERNEL32(0000009C), ref: 0040352F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F8
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403635
OleInitialize.OLE32(00000000), ref: 0040363C
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040365A
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 0040366F
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\setup.exe",00000020,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,00000007,00000009,0000000B), ref: 004036A9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 004037A2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004037B3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037BF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037DB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037EC
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004037F4
DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403808
ExitProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038AE
OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 004038B3
ExitProcess.KERNEL32 ref: 004038D4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A1B0,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 00403901
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 0040390D
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403929
DeleteFileA.KERNEL32(0041F910,0041F910,?,00425000,?,?,00000007,00000009,0000000B), ref: 00403986
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\setup.exe,0041F910,00000001), ref: 0040399B
CloseHandle.KERNEL32(00000000,0041F910,0041F910,?,0041F910,00000000,?,00000007,00000009,0000000B), ref: 004039C8
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004039F6
OpenProcessToken.ADVAPI32(00000000), ref: 004039FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A30
ExitWindowsEx.USER32(00000002,80040002), ref: 00403A55
ExitProcess.KERNEL32 ref: 00403A76

Strings

", xrefs: 004036CC
TEMP, xrefs: 004037E7
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403675, 0040367B, 0040382A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034E1
Error launching installer, xrefs: 0040386C
UXTHEME, xrefs: 004035EC, 004035F1, 004035F7
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403787, 00403886, 0040392F, 00403939
A, xrefs: 0040356A
SeShutdownPrivilege, xrefs: 00403A0B
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00403996
Low, xrefs: 004037D5
1033, xrefs: 00403803
C:\Users\user\AppData\Local\Temp, xrefs: 00403906, 0040390B, 00403938
TMP, xrefs: 004037EF
\Temp, xrefs: 004037B9
~nsu, xrefs: 004038DF
NSIS Error, xrefs: 00403660
.tmp, xrefs: 004038FB
C:\Users\user\AppData\Local\Temp\, xrefs: 00403797, 0040379C, 004037B2, 004037BE, 004037CD, 004037DA, 004037E6, 004037EE, 004038E4, 004038F5, 00403900, 0040390C, 00403919, 00403928, 004039DD
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403891

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\setup.exe"$.tmp$1033$A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2882342585-56685449
Opcode ID: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction ID: 1a4863036e4e50ed5e1acae1e6299f6db15da00d6e87979e5214c03ba8a99dba
Opcode Fuzzy Hash: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction Fuzzy Hash: 99E1D270A04354AADB21AF659D49B6F7EB89F86306F0540BFF441B61D2CB7C4A05CB2E

Function 00405B4A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405B73
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BBB
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BDC
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BE2
FindFirstFileA.KERNELBASE(00421D58,?,?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BF3
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405CA0
FindClose.KERNEL32(00000000), ref: 00405CB1

Strings

\*.*, xrefs: 00405BB5
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00405B53

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$\*.*
API String ID: 2035342205-2430568624
Opcode ID: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction ID: 9e5d3321e74a3647b1fb2cdcf4bec0a51507e3563529971eb59e862f6dba24c5
Opcode Fuzzy Hash: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction Fuzzy Hash: 2B519130908B04AAEB316B61CC49BAF7AB8DF82755F14813FF851B51D2C73C5982DE69

Function 00406A88 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction ID: c2ee61ea0ab5e5811791f69f03c7ffba3fbd093a674906ee4b434ab4c587e2e9
Opcode Fuzzy Hash: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction Fuzzy Hash: 0FF18A70D04269CBDF28CF98C8946ADBBB0FF44305F24816ED856BB281D7786A86DF45

Function 004066FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(74DF3410,004225A0,C:\,00405E4B,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 0040670A
FindClose.KERNEL32(00000000), ref: 00406716

Strings

C:\, xrefs: 004066FF

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: 083b1303d1f5dd1ba3b50291930e0491dd498af142a60d7bee4daa0eb941c193
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: B3D01231515120BBC3405B38AE0C95B7E589F093747618A36F066F22E4DB74CC6286AC

Function 00403B6E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406794: GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
Part of subcall function 00406794: GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403BE9
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,?,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,C:\Users\user\AppData\Roaming\GamePall,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410), ref: 00403C5E
lstrcmpiA.KERNEL32(?,.exe), ref: 00403C71
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403C7C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\GamePall), ref: 00403CC5

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

RegisterClassA.USER32(00423EE0), ref: 00403D02
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403D1A
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403D4F
ShowWindow.USER32(00000005,00000000,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403D85
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403DB1
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403DBE
RegisterClassA.USER32(00423EE0), ref: 00403DC7
DialogBoxParamA.USER32(?,00000000,00403F0B,00000000), ref: 00403DE6

Strings

"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403B71
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403BF8, 00403C00, 00403C98, 00403C9E, 00403CAE
RichEdit20A, xrefs: 00403DA9, 00403DAF
1033, xrefs: 00403B8E, 00403BE4
PB, xrefs: 00403B9A
.DEFAULT\Control Panel\International, xrefs: 00403BD4
Control Panel\Desktop\ResourceLocale, xrefs: 00403BA2
RichEd20, xrefs: 00403D8B
_Nb, xrefs: 00403CE1, 00403D49
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00403C2C, 00403C34, 00403C41, 00403C8B, 00403C91
>B, xrefs: 00403CD4
RichEdit, xrefs: 00403DB8
RichEd32, xrefs: 00403D99
.exe, xrefs: 00403C6B
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$>B
API String ID: 1975747703-4005560175
Opcode ID: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction ID: 5836c5bb6a6ef8c4ff0aed12ec42ff3eebf2d58129c507535c8ab2622d1094a3
Opcode Fuzzy Hash: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction Fuzzy Hash: 4F61D670204200AED620AF65AD45F3B3A7CEB8574AF41453FF951B62E2CB7D9D028B6D

Function 00402F5C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F70
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\setup.exe,00000400), ref: 00402F8C

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00402FD5
GlobalAlloc.KERNEL32(00000040,00000009), ref: 00403117

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00402FB7, 00402FBC, 00402FC2
Inst, xrefs: 00403041
soft, xrefs: 0040304A
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00402F65
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403160
Error launching installer, xrefs: 00402FAC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 004031AE
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00402F76, 00402F85, 00402F99, 00402FB6
Null, xrefs: 00403053
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F66, 0040312F

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1937576205
Opcode ID: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction ID: 8a05da1d373fd2b3e089436e62a275652004ed3b6aa6cfe031be989f12afac8e
Opcode Fuzzy Hash: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction Fuzzy Hash: 0771E231A01218ABDB20EF65DD85B9E7BACEB44356F10813BF910BA2C1D77C9E458B5C

Function 0040641B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400), ref: 00406549
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400,?,00420530,00000000,004054E1,00420530,00000000), ref: 0040655C
SHGetSpecialFolderLocation.SHELL32(004054E1,00000000,?,00420530,00000000,004054E1,00420530,00000000), ref: 00406598
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 004065A6
CoTaskMemFree.OLE32(00000000), ref: 004065B2
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D6
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530,00000000,004054E1,00420530,00000000,00000000,00000000,00000000), ref: 00406628

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D0
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406445, 00406515, 00406516, 00406517, 00406533, 00406548, 0040655B, 00406577, 004065A2, 004065D5, 004065DB, 004065F3, 00406606, 00406621, 00406627, 0040662F, 00406659
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406518

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2103940979
Opcode ID: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction ID: f38e20b3a3e0c1a2470d5ac0c6d90f06be75126661b475aa23e0086d5b044b98
Opcode Fuzzy Hash: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction Fuzzy Hash: 9F612370900114AEDF205F24EC90BBA3BA4EB52314F52403FE913B62D1D37D8A62DB4E

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe, xrefs: 00401826, 00401842
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401786

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe
API String ID: 1941528284-2333790722
Opcode ID: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction ID: 0d76be79c55a0237b493b10f9ec5be6125ba7ce9be49b25e4c886387d44134cc
Opcode Fuzzy Hash: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction Fuzzy Hash: E141B731900615BBCB107BB5CC45DAF3668EF45329B61833BF422F10E1D67C8A529AAE

Function 00406726 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
wsprintfA.USER32 ref: 00406776
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Strings

%s%s.dll, xrefs: 00406770
UXTHEME, xrefs: 0040672F
\, xrefs: 0040674E

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 0c3db372634d2cfba6f48721b0c795b31ebca02323a8b7d7371d162bf0ec7b9a
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: FBF0FC7050021966DB15A764DD0DFEA365CAB08309F1404BEA586E20C1D6B8D5258B69

Function 004027E8 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402849
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402865
GlobalFree.KERNEL32(?), ref: 004028A4
GlobalFree.KERNEL32(00000000), ref: 004028B7
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028D3
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028E6

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFree$ChangeCloseDeleteFileFindNotification
String ID:
API String ID: 2989416154-0
Opcode ID: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction ID: cd924008ac91bdcd896aacfcc8aadc4f9c7de1b4393fc14a433ce499bdbf1d56
Opcode Fuzzy Hash: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction Fuzzy Hash: D931AC32800128ABDF216FA5DE49D9E7A75FF08364F24423AF450B62D0CB7949419F68

Function 004020A5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020D0

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020E0
GetProcAddress.KERNEL32(00000000,?), ref: 004020F0
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040215A

Strings

pVn, xrefs: 0040211F

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID: pVn
API String ID: 2987980305-3982165967
Opcode ID: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction ID: efc1da79dccaef9ffb2761d2644f5cd4432d5c2edc08e83b6cf0327c91c21bf2
Opcode Fuzzy Hash: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction Fuzzy Hash: 2B210832904214E7CF207FA58E4DAAE3A60AF44358F60413FF601B61E0DBBD49819A6E

Function 00405F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F5E
GetTempFileNameA.KERNELBASE(0000000B,?,00000000,?,?,004034CA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007), ref: 00405F78

Strings

nsa, xrefs: 00405F55
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4D

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: 05c77450f8afc2c62a5a11a921c51d956a1ea51751b09822177720344b0c8500
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: 02F082363042087BDB109F55DD44BAB7B9CDF91750F14C03BFE48DA180D6B4D9988798

Function 00403A7C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403A8E
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403AA2

Strings

C:\Users\user\AppData\Local\Temp\nsiA896.tmp\, xrefs: 00403AB2
C:\Users\user\AppData\Local\Temp\, xrefs: 00403A81

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsiA896.tmp\
API String ID: 2962429428-2492047386
Opcode ID: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction ID: f2bf129958ed6937e4157d035670f95a6da1e01cb45a681b65e96f9405f647bf
Opcode Fuzzy Hash: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction Fuzzy Hash: F4E08631640B1896C130EF7CAD4D8853B189B413357204726F1B9F20F0C738A9574EE9

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040596F: CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401631

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 1892508949-2308708932
Opcode ID: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction ID: f3b3600b6319d637c5497ea1020ed17c5aedac6227b62b2eaa768bc98e31f113
Opcode Fuzzy Hash: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction Fuzzy Hash: 09115731508140EBCF306FA54D405BF23B09E96324B28453FF8D1B22E2DA3D0C42AA3E

Function 00405E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405E5B
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 00405E6B

Strings

C:\, xrefs: 00405E0E, 00405E13, 00405E19, 00405E54, 00405E5A, 00405E62, 00405E6A

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction ID: eca821d8ca18e415d707ee210574ba5bb9731226a542ad11e9256983d04766a4
Opcode Fuzzy Hash: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction Fuzzy Hash: F7F02831105D5116C6223336AD09AAF1644CE9732471A453FFCE1B52D2DB3C8A539CEE

Function 00406EBD Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction ID: 14484b0326c8a5630d33184448731c7578348ec986130544f859662fecd3ad08
Opcode Fuzzy Hash: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction Fuzzy Hash: 04A12471E04229CBDF28CFA8C844BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 004070BE Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction ID: 16a3963220edad981734dfbd86db7ae4535d0e52bcc7a87e0ef86c627c8cfaa4
Opcode Fuzzy Hash: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction Fuzzy Hash: 2D912370D04268CBDF28CF98C854BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 00406DD4 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction ID: e981be8a744509f315cfd76b32476d9c10b76e0a4aa84739a8d113cb33934a41
Opcode Fuzzy Hash: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction Fuzzy Hash: 37812471E04228CBDF24CFA8C844BADBBB1FF45305F24816AD856BB291C7789986DF45

Function 004068D9 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction ID: 8182d74baebb800b0d472bca2432a1a472ea96a2662ae7b36db949844af6c4d7
Opcode Fuzzy Hash: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction Fuzzy Hash: DF815971E04228DBEF24CFA8C844BADBBB1FF44305F10816AD956BB281C7786986DF45

Function 00406D27 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction ID: 516ab04208dd2bc2fd7cdea6c41d3130492ff38fa800e35acf718bd73fbf6333
Opcode Fuzzy Hash: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction Fuzzy Hash: A4712271E04228CBDF24CF98C844BADBBB1FF48305F14806AD856BB281C778A986DF45

Function 00406E45 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction ID: 835baf8de871759411e2c74e4a47f0112f02d54065241c3c7dcda5dc236b3f46
Opcode Fuzzy Hash: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction Fuzzy Hash: 92712571E04228CBEF28CF98C844BADBBB1FF44305F15816AD856BB281C7786996DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction ID: ccec74d0ee3a806077926e8984c2e201e8b1f3d886c73ab216be699138b2bca7
Opcode Fuzzy Hash: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction Fuzzy Hash: 39715771E04228CBEF28CF98C844BADBBB1FF44305F14806AD956BB281C778A946DF45

Function 00403305 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403319

Part of subcall function 00403484: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 0040334C
SetFilePointer.KERNELBASE(155C335B,00000000,00000000,004138F8,00004000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000), ref: 00403447

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction ID: 5f41a1ef9683aad456499e8308d87ccfcfa217f8aa92108fcff4f05b83e24891
Opcode Fuzzy Hash: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction Fuzzy Hash: 1F319F72A002059FC711BF2AFE849663BACE741356710C13BE814B62F0CB3859458FAD

Function 0040247E Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC20,00000023,00000011,00000002), ref: 004024C9
RegSetValueExA.KERNELBASE(?,?,?,?,0040AC20,00000000,00000011,00000002), ref: 00402509
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction ID: e1e6ae2a7b536448810537a1ffa9a52b32d6c636ce9630cd27147c6707bb0a71
Opcode Fuzzy Hash: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction Fuzzy Hash: 04116371E04208AFEB10AFA5DE49AAEBA74EB84714F21443BF504F71C1DAB94D409B68

Function 00402590 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C2
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025D5
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction ID: 33ff3e85e785963e302667c06a3cb1355a7acd8bf142a31c2560ef5bcfc7d759
Opcode Fuzzy Hash: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction Fuzzy Hash: 2C017571904104FFE7158F54DE88ABF7BACEF81358F20443EF101A61C0DAB44E449679

Function 00405B02 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF6: GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
Part of subcall function 00405EF6: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B1D
DeleteFileA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B25
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B3D

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction ID: eeb49a2f717892c2e0964ab94aaac89db2a73fdd151ed94c70539e0cf44bba43
Opcode Fuzzy Hash: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction Fuzzy Hash: 6CE0E531109A9097C62067349908A5B7AF8EF86314F094D3AF9A1F20D0DB38B9468EBD

Function 004031FD Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 00403222

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction ID: 301e065564a74905a78554ad982773151ad037ba2d6e6f8d8cd401a7b941de18
Opcode Fuzzy Hash: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction Fuzzy Hash: E2318D30200219FFDB109F95ED45A9A3FA8EB05755B20847EB914E61D0D738DB509FA9

Function 0040251E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040254E
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction ID: 7c766f3f1fb2abd04e903467a79d83897fdaad9d0bba0580308fe752c8381985
Opcode Fuzzy Hash: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction Fuzzy Hash: 1B11BF71905205EFDB25CF64DA985AE7BB4AF11355F20483FE042B72C0D6B88A85DA1D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction ID: c6e23866af321c238b4b59365f681da1ab702c54c00e726fca3ee5b0521d1f72
Opcode Fuzzy Hash: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction Fuzzy Hash: 5201D131B242109BE7194B38AE04B2A36A8E754315F51813AF851F61F1DB78CC129B4D

Function 00405A21 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
CloseHandle.KERNEL32(?), ref: 00405A57

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 70dcd79ab4e1e9e84cc9ba673cd08f466e07e48f17d85ed3475224309c024e1a
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: A5E04FB4600209BFEB009B64ED09F7B77ACFB04244F808421BE40F2150D67899658A78

Function 00406794 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

Part of subcall function 00406726: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
Part of subcall function 00406726: wsprintfA.USER32 ref: 00406776
Part of subcall function 00406726: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction ID: 2a593beb9babc16b4b5ae8275dbdfb46ef4ebf17ea7291b62b5d373670c31446
Opcode Fuzzy Hash: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction Fuzzy Hash: B6E0863260421157D21067705E4897773ACAF94B54302043EF546F3144D7389C76966D

Function 00405F1B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Function 00405EF6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction ID: 2a9487917742c73a52daa6fa2dda6e447083e2efb983b62a69771bacbdb33add
Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction Fuzzy Hash: E3D0C972504422ABD2102728AE0889BBB55DB94271702CA35FDA5A26F1DB304C569A9C

Function 004059EC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004034BF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004059F2
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405A00

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: 42ce2bd36b25b14d2ed8d631edf33fc643f4c4eb5ed9af5e51ab4a49ffb09bba
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: 9BC04C303145419AD6505B309F4DB177A54AB50741F51553A638AE01A0DA348465DD2D

Function 0040623C Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CEA,00000000,?,?), ref: 00406265

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 57b18be241489d6c3509c0f1b2cb500900bdd64e2c84313365475615acd8ae2e
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 16E0E672010109BEDF196F50DD0AD7B371DEB04341F01492EF916D4091E6B5A9309734

Function 00405FC2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0040C475,0040B8F8,00403405,0040B8F8,0040C475,004138F8,00004000,?,00000000,0040322F,00000004), ref: 00405FD6

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d5187e51ab0d96a1766449b5dbb93cac2cdd9e80b7d20ab2fc0b5d8c8d5322e8
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 4AE0EC3221065BABDF109E659C04EEB7B6CEB05360F004437FA55E3150D675E8219BA4

Function 00405F93 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,004138F8,0040B8F8,00403481,00000009,00000009,00403385,004138F8,00004000,?,00000000,0040322F), ref: 00405FA7

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: 61a6516da629700e98a59d605e8380186fb5f41ecf47873683bd74a9a2ef61d4
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: 8BE08C3220161EEBEF119E508C00AEBBB6CEB00360F004433FD25E3140E234E9218BA8

Function 00403484 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Part of subcall function 00405A21: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
Part of subcall function 00405A21: CloseHandle.KERNEL32(?), ref: 00405A57

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406809: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
Part of subcall function 00406809: GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction ID: dce1314ccbc215d7d9c334b017be086f7c4cc40ba0f87dfe0d8145fd67a5eb82
Opcode Fuzzy Hash: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction Fuzzy Hash: 2DF0B432A05121DBDB20BFA59EC49EEB2A4DF41318B25463FF502B21D1CB7C4D418A6E

Non-executed Functions

Function 004055E7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405646
GetDlgItem.USER32(?,000003EE), ref: 00405655
GetClientRect.USER32(?,?), ref: 00405692
GetSystemMetrics.USER32(00000002), ref: 00405699
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004056BA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004056CB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004056DE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004056EC
SendMessageA.USER32(?,00001024,00000000,?), ref: 004056FF
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405721
ShowWindow.USER32(?,00000008), ref: 00405735
GetDlgItem.USER32(?,000003EC), ref: 00405756
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405766
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040577F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040578B
GetDlgItem.USER32(?,000003F8), ref: 00405664

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

GetDlgItem.USER32(?,000003EC), ref: 004057A7
CreateThread.KERNEL32(00000000,00000000,Function_0000557B,00000000), ref: 004057B5
CloseHandle.KERNEL32(00000000), ref: 004057BC
ShowWindow.USER32(00000000), ref: 004057DF
ShowWindow.USER32(?,00000008), ref: 004057E6
ShowWindow.USER32(00000008), ref: 0040582C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405860
CreatePopupMenu.USER32 ref: 00405871
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405886
GetWindowRect.USER32(?,000000FF), ref: 004058A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058BF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004058FB
OpenClipboard.USER32(00000000), ref: 0040590B
EmptyClipboard.USER32 ref: 00405911
GlobalAlloc.KERNEL32(00000042,?), ref: 0040591A
GlobalLock.KERNEL32(00000000), ref: 00405924
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405938
GlobalUnlock.KERNEL32(00000000), ref: 00405951
SetClipboardData.USER32(00000001,00000000), ref: 0040595C
CloseClipboard.USER32 ref: 00405962

Strings

PB, xrefs: 004058D7

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction ID: 44a2cb424ceca129f1c721a27905a8e57bc1109532c064cce4e419f7e60c3497
Opcode Fuzzy Hash: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction Fuzzy Hash: 18A13971900608FFDB11AF64DE85AAE7BB9FB48355F00403AFA41BA1A0CB754E51DF58

Function 00404E0A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E21
GetDlgItem.USER32(?,00000408), ref: 00404E2E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E7D
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E94
SetWindowLongA.USER32(?,000000FC,0040541D), ref: 00404EAE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EC0
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404ED4
SendMessageA.USER32(?,00001109,00000002), ref: 00404EEA
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404EF6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F06
DeleteObject.GDI32(00000110), ref: 00404F0B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404F36
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404FDC
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 0040500C

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

SendMessageA.USER32(?,00001100,00000000,?), ref: 00405020
GetWindowLongA.USER32(?,000000F0), ref: 0040504E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 0040505C
ShowWindow.USER32(?,00000005), ref: 0040506C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405167
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004051CC
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004051E1
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405205
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405225
ImageList_Destroy.COMCTL32(?), ref: 0040523A
GlobalFree.KERNEL32(?), ref: 0040524A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004052C3
SendMessageA.USER32(?,00001102,?,?), ref: 0040536C
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040537B
InvalidateRect.USER32(?,00000000,00000001), ref: 004053A6
ShowWindow.USER32(?,00000000), ref: 004053F4
GetDlgItem.USER32(?,000003FE), ref: 004053FF
ShowWindow.USER32(00000000), ref: 00405406

Strings

N, xrefs: 004050A5
, xrefs: 004053DE
M, xrefs: 00404FC4

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction ID: c306c4130ea67d8582adb4b0d0e706bf782d7aff15223233fd0d43401108afdf
Opcode Fuzzy Hash: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction Fuzzy Hash: 6C025CB0A00609AFDB209F94DD45AAE7BB5FB84354F10817AF610BA2E1D7789D42CF58

Function 00403F0B Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F47
ShowWindow.USER32(?), ref: 00403F67
GetWindowLongA.USER32(?,000000F0), ref: 00403F79
ShowWindow.USER32(?,00000004), ref: 00403F92
DestroyWindow.USER32 ref: 00403FA6
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403FBF
GetDlgItem.USER32(?,?), ref: 00403FDE
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403FF2
IsWindowEnabled.USER32(00000000), ref: 00403FF9
GetDlgItem.USER32(?,00000001), ref: 004040A4
GetDlgItem.USER32(?,00000002), ref: 004040AE
SetClassLongA.USER32(?,000000F2,?), ref: 004040C8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404119
GetDlgItem.USER32(?,00000003), ref: 004041BF
ShowWindow.USER32(00000000,?), ref: 004041E0
EnableWindow.USER32(?,?), ref: 004041F2
EnableWindow.USER32(?,?), ref: 0040420D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404223
EnableMenuItem.USER32(00000000), ref: 0040422A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404242
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404255
lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 0040427F
SetWindowTextA.USER32(?,00420D50), ref: 0040428E
ShowWindow.USER32(?,0000000A), ref: 004043C2

Strings

PB, xrefs: 0040426F

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: PB
API String ID: 1860320154-3196168531
Opcode ID: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction ID: 6b3c419a8b2de2434844e8cd53afab52d63163afb5b1bd925d395a768d9dd0e6
Opcode Fuzzy Hash: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction Fuzzy Hash: ECC1D2B1A00204BBCB206F61EE45E2B3A78EB85745F41053EF781B61F1CB3998929B5D

Function 00404570 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004045FB
GetDlgItem.USER32(00000000,000003E8), ref: 0040460F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040462D
GetSysColor.USER32(?), ref: 0040463E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040464D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040465C
lstrlenA.KERNEL32(?), ref: 0040465F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040466E
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404683
GetDlgItem.USER32(?,0000040A), ref: 004046E5
SendMessageA.USER32(00000000), ref: 004046E8
GetDlgItem.USER32(?,000003E8), ref: 00404713
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404753
LoadCursorA.USER32(00000000,00007F02), ref: 00404762
SetCursor.USER32(00000000), ref: 0040476B
LoadCursorA.USER32(00000000,00007F00), ref: 00404781
SetCursor.USER32(00000000), ref: 00404784
SendMessageA.USER32(00000111,00000001,00000000), ref: 004047B0
SendMessageA.USER32(00000010,00000000,00000000), ref: 004047C4

Strings

N, xrefs: 00404701
6B, xrefs: 0040476F

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction ID: 424ea1d81b5f8fd67bb79b8421ee67f108f717641e3cc5fc4ea293435da972af
Opcode Fuzzy Hash: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction Fuzzy Hash: CE6190B1A40208BFDB109F61DD45B6A7B69FB84715F10843AFB01BB2D1C7B8A951CF98

Function 00405FF1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
GetShortPathNameA.KERNEL32(?,00422AE0,00000400), ref: 0040602B

Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

GetShortPathNameA.KERNEL32(?,00422EE0,00000400), ref: 00406048
wsprintfA.USER32 ref: 00406066
GetFileSize.KERNEL32(00000000,00000000,00422EE0,C0000000,00000004,00422EE0,?,?,?,?,?), ref: 004060A1
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,004226E0,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
GlobalFree.KERNEL32(00000000), ref: 0040614F
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406156

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Strings

.B, xrefs: 00406044
*B, xrefs: 00406010
%s=%s, xrefs: 0040605C
[Rename], xrefs: 004060D0, 004060E2
.B, xrefs: 0040603D

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]$*B$.B$.B
API String ID: 2171350718-3836630945
Opcode ID: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction ID: 7566a5a9e9d08134d14435fb5d3e1561ad96112206bac95af022f508aac3f812
Opcode Fuzzy Hash: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction Fuzzy Hash: 68310531200715BBC2207B659D49F6B3A5DDF85754F15003EFE42BA2C3EA7CD8228AAD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction ID: bc851ab26da2bb863bf3a2ee07eb2f950de800ada4cbee7b2d64f78586a04119
Opcode Fuzzy Hash: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction Fuzzy Hash: 2C419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C734DA55DFA4

Function 00404897 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048E6
SetWindowTextA.USER32(00000000,?), ref: 00404910
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 004049C1
CoTaskMemFree.OLE32(00000000), ref: 004049CC
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420D50), ref: 004049FE
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 00404A0A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404A1C

Part of subcall function 00405A82: GetDlgItemTextA.USER32(?,?,00000400,00404A53), ref: 00405A95

Part of subcall function 00406666: CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
Part of subcall function 00406666: CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
Part of subcall function 00406666: CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
Part of subcall function 00406666: CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404ADA
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AF5

Part of subcall function 00404C4E: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
Part of subcall function 00404C4E: wsprintfA.USER32 ref: 00404CF4
Part of subcall function 00404C4E: SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

A, xrefs: 004049BA
PB, xrefs: 00404994
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 004049F8, 004049FD, 00404A08
C:\Users\user\AppData\Roaming\GamePall, xrefs: 004049E7

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$PB
API String ID: 2624150263-3665957329
Opcode ID: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction ID: 03633cdec68ae3b48ba4c7d33c4768738bfb21d85bfcf2e4b9185cba9ee35c0f
Opcode Fuzzy Hash: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction Fuzzy Hash: 7DA150B1A00208AADB11EFA5DD45BAFB6B8EF84315F10803BF601B62D1D77C99418F6D

Function 004054A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
SetWindowTextA.USER32(00420530,00420530), ref: 00405517
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

4/@, xrefs: 004054EF, 00405501

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: 4/@
API String ID: 2531174081-3101945251
Opcode ID: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction ID: 7ab3267fb946cf8e7efc5916356ec1270af3577e2396c2c3629ce5ef3fcb69de
Opcode Fuzzy Hash: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction Fuzzy Hash: 0F217A71E00118BBCF119FA5DD8099EBFB9EF09354F04807AF944A6291C7788A90CFA8

Function 00406666 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

Strings

"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00406666
*?|<>/":, xrefs: 004066AE
C:\Users\user\AppData\Local\Temp\, xrefs: 00406667

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1678727643
Opcode ID: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction ID: 80d428334b402c3338f843ea799862c1973996ffb1638880579f4ae0c72fc655
Opcode Fuzzy Hash: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction Fuzzy Hash: 7E1108518047902DEB3206340C04B7B7F894F977A0F2A087FD8C6722C2D67E5C62967D

Function 00402EBD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402ED5
GetTickCount.KERNEL32 ref: 00402EF3
wsprintfA.USER32 ref: 00402F21

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

CreateDialogParamA.USER32(0000006F,00000000,00402E25,00000000), ref: 00402F45
ShowWindow.USER32(00000000,00000005), ref: 00402F53

Part of subcall function 00402EA1: MulDiv.KERNEL32(00000000,00000064,0000D822), ref: 00402EB6

Strings

#Vh%.@, xrefs: 00402F34
... %d%%, xrefs: 00402F1B

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%$#Vh%.@
API String ID: 722711167-1706192003
Opcode ID: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction ID: ac0ca11ee9366edb0cc6a28cc5aeb329eacd7d00ab00b3c3670f6d564c8935e4
Opcode Fuzzy Hash: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction Fuzzy Hash: 3F01A170542225EBCB21BB50EF0CBAB3778EB40744B04443BF505B21D0C7F894469AEE

Function 0040446C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404489
GetSysColor.USER32(00000000), ref: 004044C7
SetTextColor.GDI32(?,00000000), ref: 004044D3
SetBkMode.GDI32(?,?), ref: 004044DF
GetSysColor.USER32(?), ref: 004044F2
SetBkColor.GDI32(?,?), ref: 00404502
DeleteObject.GDI32(?), ref: 0040451C
CreateBrushIndirect.GDI32(?), ref: 00404526

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction ID: 76b6fc4927f6120469f5ffa52701fcd3ddd76896e52d32ad6f55637f73cee333
Opcode Fuzzy Hash: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction Fuzzy Hash: 9E2147B1501704AFCB31DF68ED08B5BBBF8AF41715B04892EEA96A26E0D734E904CB54

Function 00404D58 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404D73
GetMessagePos.USER32 ref: 00404D7B
ScreenToClient.USER32(?,?), ref: 00404D95
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404DA7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404DCD

Strings

f, xrefs: 00404DA9

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: de178be9688f757f82ef56a4cbeb6693d0582b60b2ea90e1a00f6814b48fd044
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: BB014871900219BADB01DBA4DD85BFEBBF8AF95B11F10016ABA40B61C0C6B499058BA4

Function 0040596F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2
GetLastError.KERNEL32 ref: 004059C6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004059DB
GetLastError.KERNEL32 ref: 004059E5

Strings

!9@, xrefs: 00405984
C:\Users\user\AppData\Local\Temp\, xrefs: 00405995

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: !9@$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-2369717338
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: 4cd508ff09270142ca7a6984d66ae253fefa4e1f6983b248f3af4f59f5a14231
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 610108B1D00259DAEF109BA0CA45BEFBBB8EB04354F00403AD645B6290D7789648CF99

Function 00402E25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E40
wsprintfA.USER32 ref: 00402E74
SetWindowTextA.USER32(?,?), ref: 00402E84
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E96

Strings

unpacking data: %d%%, xrefs: 00402E62
verifying installer: %d%%, xrefs: 00402E69, 00402E72

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction ID: 7ad4584a5e884be7344c254f70e0401137e7e46ce86c3cf658bb2ab9d23be74a
Opcode Fuzzy Hash: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction Fuzzy Hash: 1DF01D7054020DBAEF219F60DE0ABAE3769EB44344F00803AFA16B91D0DBB899558F99

Function 00404C4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
wsprintfA.USER32 ref: 00404CF4
SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

PB, xrefs: 00404CDE
%u.%u%s%s, xrefs: 00404CD6

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$PB
API String ID: 3540041739-838025833
Opcode ID: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction ID: 635705270cf82d3fa6c033b13715314544988666452c3f341a93ad76d23c3d90
Opcode Fuzzy Hash: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction Fuzzy Hash: 5F11E77360512837EB00656D9D45EAE3298DB85374F26423BFE26F71D1E978CC1286E8

Function 00402D3B Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402DDB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DE4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402DFB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E06

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction ID: 1f7d8097ab2fb743d310579a2b4365e3e31c1a4ec17ce584dda370d325fd3950
Opcode Fuzzy Hash: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction Fuzzy Hash: 1D214B7150010CBBDF129F90CE89EEB7B7DEF44344F11007AF955B11A0D7B49EA49AA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction ID: cb7cd4706ec086029cb46641885d9617bace417a5341e65c45b3777010ef1041
Opcode Fuzzy Hash: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction Fuzzy Hash: 35212A72E00109AFDF15DFA4DD85AAEBBB5EB88300F24417EF911F62A0DB389941DB14

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction ID: bfe7ce59390996d5b2ac71ca67757b7c78ff13e1b53bdd881068f9c0e557254e
Opcode Fuzzy Hash: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction Fuzzy Hash: 66018072504340AEE7007BB0AF8AA9A7FE8E755701F109439F241B61E2CB790449CB6C

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction ID: a12cfbdd51ff26f17676da16b1bc06906883597644a76ef85f46b7bf1251d8d3
Opcode Fuzzy Hash: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction Fuzzy Hash: 2A218271948208BEEB059FF5DA8AAAD7FB4EF84304F20447EF101B61D1D7B989819B18

Function 00405D1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D20
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D29
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D1A

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction ID: 6a6775ee8fa4d5d8d60a890cb1840bbff54d6a4bc9e312217f61a2b57c53a4e0
Opcode Fuzzy Hash: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction Fuzzy Hash: 82D0A7625015307AD20167154C09DDF29488F523017094027F501B7191C67C5C1187FD

Function 00401B87 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(006E5670), ref: 00401BF6
GlobalAlloc.KERNEL32(00000040,00000404), ref: 00401C08

Strings

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00401BAE, 00401BB4, 00401BCE
pVn, xrefs: 00401B8A, 00401BBA, 00401BC9, 00401BF1, 00401C1C, 00401C23

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFree
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$pVn
API String ID: 3394109436-713061468
Opcode ID: 1742c790c76e1204b36b83cb8595e4f796a64baec2cc559805630d203923ff3a
Instruction ID: d16732292a7d53aa36264d1983316191a85a40c43d81ca2894a5c6bdb3dae948
Opcode Fuzzy Hash: 1742c790c76e1204b36b83cb8595e4f796a64baec2cc559805630d203923ff3a
Instruction Fuzzy Hash: 6921A872600208ABC720EB65CEC495E73E8EB89314765493BF502F72E1DB7CA8518B9D

Function 00405DB3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
CharNextA.USER32(00000000), ref: 00405DC6
CharNextA.USER32(00000000), ref: 00405DDA

Strings

C:\, xrefs: 00405DB4

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction ID: a81d310af092f64b8c374c4571b8fed5a60269d48026fa3bbeeaae68e06855d2
Opcode Fuzzy Hash: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction Fuzzy Hash: 71F09661904F542BFB3293648C4CB776B8DCF55351F28947BE6807A6C1C27C59808FEA

Function 00402173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022AA

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00402238

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 123533781-2308708932
Opcode ID: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction ID: 4a55140eb955682c0845ac661669d1effe53c60cfc8a987c49de3bb9103baba8
Opcode Fuzzy Hash: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction Fuzzy Hash: B2513575A00208AFDF10DFE4CA88A9D7BB5EF48314F2045BAF505EB2D1DA799981CB54

Function 0040541D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040544C
CallWindowProcA.USER32(?,?,?,?), ref: 0040549D

Part of subcall function 00404451: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404463

Strings

, xrefs: 0040542D

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction ID: ce4d6245f7a5538c18ae28323cba1b5bdda0ccdff68052f186ad3da5f1ae13b7
Opcode Fuzzy Hash: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction Fuzzy Hash: 2A015E31200608AFDF216F51DD80BAF3A66EB84716F104537FA05761D2C7799CD29F6A

Function 0040626F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420530,?,?,?,00000002,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00406527,80000002), ref: 004062B5
RegCloseKey.ADVAPI32(?,?,00406527,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530), ref: 004062C0

Strings

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406272, 004062A6

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
API String ID: 3356406503-2798812489
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: 5c8aa4f59809ec7c4ed175be077f356401e74c3ba082423fbe1b6bbc42bea5f4
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 8101BC72100209ABDF229F60CC09FDB3FA8EF45364F01407AFD56A6190D638C974CBA8

Function 00405D61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D67
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D75

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405D61

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-47812868
Opcode ID: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction ID: 27c40c0738421aba4af956c8f0f705930dfe744a77a65273bf6dbb66402e0641
Opcode Fuzzy Hash: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction Fuzzy Hash: CBD0A772409D706EE31353208C04B8F6A48CF13300F0D4063E481A6190C2785C424BFD

Function 00405E80 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405EA8
CharNextA.USER32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EB9
lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

Memory Dump Source

Source File: 0000000B.00000002.3373599818.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3373568822.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373632112.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373661700.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3373757467.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 98ea32bb50e75ca8be10b873c57fc005eda9f523d07111d413316ed06cfa332a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 5FF06235104918AFCB129BA5DD4099EBFA8EF55350B2540B9E880F7211D674DF019BA9

Analysis Process: GamePall.exePID: 7564, Parent PID: 5236COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	73%
Signature Coverage:	0%
Total number of Nodes:	74
Total number of Limit Nodes:	3

Executed Functions

Function 63D37460 Relevance: 1.9, Strings: 1, Instructions: 616COMMON

Download Yara Rule

Strings

H#Vj, xrefs: 63D37971

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063D37000.00000020.00000001.01000000.00000015.sdmp, Offset: 63D37000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63d37000_GamePall.jbxd

Similarity

API ID:
String ID: H#Vj
API String ID: 0-73999843
Opcode ID: ca1c17bcb72a556e67e308ba237f2a1db908a371c8c95d68d3144bcc6a9d057e
Instruction ID: a274d90fd165a70fa8007c63e83b9a1672bcc6f351cf580f27a0a99839e6781b
Opcode Fuzzy Hash: ca1c17bcb72a556e67e308ba237f2a1db908a371c8c95d68d3144bcc6a9d057e
Instruction Fuzzy Hash: 7B329DB1A00B41DFD724CF28C480A16B7F1FF8A714F148A2DE89A87A51EB70F955CB91

Function 61DAB440 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 379
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CertControlStore.CRYPT32(?,00000000,00000004,00000000), ref: 61DAB725
CertControlStore.CRYPT32(?,00000000,00000004,00000000), ref: 61DAB73B
CertControlStore.CRYPT32(?,00000000,00000004,00000000), ref: 61DAB750

Strings

Hi, xrefs: 61DAB630
Hi, xrefs: 61DAB689

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061DAB000.00000020.00000001.01000000.00000015.sdmp, Offset: 61DAB000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61dab000_GamePall.jbxd

Similarity

API ID: CertControlStore
String ID: Hi$Hi
API String ID: 423745413-1739031191
Opcode ID: 3d912c476badd5450e711841858c173de5cc7e41b99945da135f34d300b3a884
Instruction ID: 2f8c168a49c7f938cd2b4463c95ed20a4d43aaa2b7ec0daf95e95287b11e680d
Opcode Fuzzy Hash: 3d912c476badd5450e711841858c173de5cc7e41b99945da135f34d300b3a884
Instruction Fuzzy Hash: 3ED180B1A04345ABD711DF29CC40B6BBBE8AF99304F10852EF888D3641EB74E555CBE2

Function 0256D3F0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0256D46E
GetCurrentThread.KERNEL32 ref: 0256D4AB
GetCurrentProcess.KERNEL32 ref: 0256D4E8
GetCurrentThreadId.KERNEL32 ref: 0256D541

Memory Dump Source

Source File: 0000000C.00000002.3447496175.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2560000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 67851a9a05c27a41392f9043245888959fe4f4057b8f15d2baa5ed8696880d7f
Instruction ID: 0b0eab9f4c52ff92fe98aa81e9ab3108c1660c70f0c4351cc5e0c3a21f6cb727
Opcode Fuzzy Hash: 67851a9a05c27a41392f9043245888959fe4f4057b8f15d2baa5ed8696880d7f
Instruction Fuzzy Hash: 255146B0A012098FDB14DFA9D548BEEBBF1FB88304F20C459E019A7360D775A944CF66

Function 0256D3E0 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0256D46E
GetCurrentThread.KERNEL32 ref: 0256D4AB
GetCurrentProcess.KERNEL32 ref: 0256D4E8
GetCurrentThreadId.KERNEL32 ref: 0256D541

Memory Dump Source

Source File: 0000000C.00000002.3447496175.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2560000_GamePall.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f5cc56ed99aa07b01079aacbf7d579e9dbddf7616c691783624c8e53eea39ec0
Instruction ID: 743390847506345d3fa401b2a016844c6808f7ba4c51dc32a10c214c8fdae316
Opcode Fuzzy Hash: f5cc56ed99aa07b01079aacbf7d579e9dbddf7616c691783624c8e53eea39ec0
Instruction Fuzzy Hash: 3A5144B4A01249CFDB18CFA9D548BAEBBF1FB88304F248459D019A7361D735A944CF66

Function 61E89E73 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,00000000,00000000,?,?,?,80000000,80000000,?,00000000,00000000), ref: 61E89F4A

Strings

P, xrefs: 61E89E85
?, xrefs: 61E89F75

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061E89000.00000020.00000001.01000000.00000015.sdmp, Offset: 61E89000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61e89000_GamePall.jbxd

Similarity

API ID: CreateWindow
String ID: ?$P
API String ID: 716092398-1257622509
Opcode ID: 2cd1c83a6a6366611a0d2b315b4092931f8529458b59de60ec0b2a272fd99836
Instruction ID: 5c2ad2c2f2efa3ff2ad5b091bd60f37e3dd9731bd7446dba61357e8385aac70b
Opcode Fuzzy Hash: 2cd1c83a6a6366611a0d2b315b4092931f8529458b59de60ec0b2a272fd99836
Instruction Fuzzy Hash: 3E419071D003099FDB01CFA4C8446AEBBF5FF99308F20852DE84997351E7369906CB51

Function 068824D8 Relevance: 5.0, Strings: 4, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0688268B
$^q, xrefs: 0688259E
$^q, xrefs: 06882697
$^q, xrefs: 068825AA

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: f71982d03347a4c9aa90d1900cbb2bb96d2ddcc6d956086cceb3c1b3816b2799
Instruction ID: bcf1cefc2e68ccccd48a422a0511076b9d0624854ff83eb8b23af1e3dae4c551
Opcode Fuzzy Hash: f71982d03347a4c9aa90d1900cbb2bb96d2ddcc6d956086cceb3c1b3816b2799
Instruction Fuzzy Hash: C4C0923010A2A05FD3A39B6888F1C80BFB1EF131413164A8BE4C2DB752C11A5D97CB71

Function 0688A7C8 Relevance: 3.9, Strings: 3, Instructions: 167
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 0688A905
(bq, xrefs: 0688A881
Hbq, xrefs: 0688A8AD

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$Hbq$Hbq
API String ID: 0-2817990774
Opcode ID: ef5f39e4040e8a0fe0d5373c065009a6a06b5e725e1c817f4cd661cc8492c8cb
Instruction ID: 128180d798725630109d824d20926883d4470d5c1ffc8b6e230510ddc91624e7
Opcode Fuzzy Hash: ef5f39e4040e8a0fe0d5373c065009a6a06b5e725e1c817f4cd661cc8492c8cb
Instruction Fuzzy Hash: 7B51B134B401599FC758EF68D84097E7BB6EFC8751B10816AE906DB390DB31AD42CBE1

Function 068896F0 Relevance: 3.8, Strings: 3, Instructions: 86COMMON

Download Yara Rule

Strings

$^q, xrefs: 0688987F
(bq, xrefs: 06889984
$^q, xrefs: 0688988B

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$$^q$$^q
API String ID: 0-1326376818
Opcode ID: 874c9438086fa3077ab25da6b889d9b17f0936ea4d19faaed5c9028d817b2f6c
Instruction ID: 62cea7061d28283386dff4b3139610a2e4f4bcd7faa010f17933ed443922119a
Opcode Fuzzy Hash: 874c9438086fa3077ab25da6b889d9b17f0936ea4d19faaed5c9028d817b2f6c
Instruction Fuzzy Hash: 0C21A1306182598FEFB87E2DC8E137D73B8EB06354F184467E247CA992D95DE8C1C286

Function 61E89E30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,00000000,00000000,?,?,?,80000000,80000000,?,00000000,00000000), ref: 61E89F4A

Strings

?, xrefs: 61E89F75

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061E89000.00000020.00000001.01000000.00000015.sdmp, Offset: 61E89000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61e89000_GamePall.jbxd

Similarity

API ID: CreateWindow
String ID: ?
API String ID: 716092398-1684325040
Opcode ID: d8f73b68c26d7c63281a243a4250aff37a96b74f35d2042f33cd33979b1585c6
Instruction ID: 2ec764a51eaab6784472f6bc03b6637f3097f488d95648ef348fe51037d3a63a
Opcode Fuzzy Hash: d8f73b68c26d7c63281a243a4250aff37a96b74f35d2042f33cd33979b1585c6
Instruction Fuzzy Hash: 8641C171D003099BEB05CFA4C8446AEBBF5BF99318F24861EE81997391E736D906CB50

Function 61D929AF Relevance: 2.6, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

l `j, xrefs: 61D929C8
p `j, xrefs: 61D929BE

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061D92000.00000020.00000001.01000000.00000015.sdmp, Offset: 61D92000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61d92000_GamePall.jbxd

Similarity

API ID:
String ID: l `j$p `j
API String ID: 0-676915400
Opcode ID: 4458b6d34b1cbc6a9e155d15c8895e0c816c544e1c5820a502253fbc70514000
Instruction ID: 4522bbafd601b6e46f435eac159e89dbf69d9deff8fbcfdea79d585f992dc282
Opcode Fuzzy Hash: 4458b6d34b1cbc6a9e155d15c8895e0c816c544e1c5820a502253fbc70514000
Instruction Fuzzy Hash: AF51D3B19047018FD320DF38D9517ABBBE5BFD9318F018E0EE49A87251EB74A590CB92

Function 059FDC91 Relevance: 2.5, Strings: 2, Instructions: 24COMMON

Download Yara Rule

Strings

$^q, xrefs: 059FDCAA
$^q, xrefs: 059FDC9A

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 466ba0dfe5cb3d893955705fa50cb0cf22165f99c5713ebc2684f8a5defd9483
Instruction ID: 872d70c46f1f35eef0c8bc186aa3152601902b7ba0bad639e0c1464179868a5f
Opcode Fuzzy Hash: 466ba0dfe5cb3d893955705fa50cb0cf22165f99c5713ebc2684f8a5defd9483
Instruction Fuzzy Hash: BAF03930B00208DFCB18CF05D4848A97BB2BB84355B60C465E6064F714C730E945CB80

Function 63C462B8 Relevance: 2.1, Strings: 1, Instructions: 840COMMON

Download Yara Rule

Strings

nla, xrefs: 63C468A9

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063C44000.00000020.00000001.01000000.00000015.sdmp, Offset: 63C44000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63c44000_GamePall.jbxd

Similarity

API ID:
String ID: nla
API String ID: 0-2599129657
Opcode ID: 355c47837272623b4682af69bbf8507ec722728f9ba70a3d2147e62f5eedf789
Instruction ID: 8671e28901f9281896ce7b2fc8079b5746bd3c0df33308e26487b3d090508ffe
Opcode Fuzzy Hash: 355c47837272623b4682af69bbf8507ec722728f9ba70a3d2147e62f5eedf789
Instruction Fuzzy Hash: 695215B1E006589FEB14DF58C880B9EBBB5FB45B04F148129F815EB346FB31A9518BA1

Function 6358A000 Relevance: 1.7, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(00000000,?,?,FFFFFFFF,00000000,00000000,00000003), ref: 6358A0B6

Memory Dump Source

Source File: 0000000C.00000002.4791869623.000000006358A000.00000020.00000001.01000000.00000015.sdmp, Offset: 6358A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6358a000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e646741689dda02cb0a649230cb58a06b4e270a67b8eaad52a392c31099b6301
Instruction ID: aa344e0508073e1a2b6c4ecf9804fbe1cdaba7421de604899685c438181905b8
Opcode Fuzzy Hash: e646741689dda02cb0a649230cb58a06b4e270a67b8eaad52a392c31099b6301
Instruction Fuzzy Hash: 4251DD75900219EFDF10DFA4D884BEEBBB6FF49754F140029E801AB281D732AC45CBA0

Function 06A903EC Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A9050A

Memory Dump Source

Source File: 0000000C.00000002.4727029481.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6a90000_GamePall.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8d4597df1a1dea9d55c16219b1e10d5b20826ab153a09b7d1a33679028c06572
Instruction ID: 5bcbb55837d2e471dee155bf9d9ee26b65f3cee841623c4f3a7fa08df39141a7
Opcode Fuzzy Hash: 8d4597df1a1dea9d55c16219b1e10d5b20826ab153a09b7d1a33679028c06572
Instruction Fuzzy Hash: DC51BDB1D00349AFDF14CFA9C884ADEBBB5BF48350F24812AE819AB210D7719885CF91

Function 06A903F8 Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 06A9050A

Memory Dump Source

Source File: 0000000C.00000002.4727029481.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6a90000_GamePall.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 595dd50f2b447ce7c48a3edf7542deb87cd8f714f993734c0056a8827703b81c
Instruction ID: be1ad361e7b52eb987483eac81c05e09784994bc03b74f58525bf9cf40e98e67
Opcode Fuzzy Hash: 595dd50f2b447ce7c48a3edf7542deb87cd8f714f993734c0056a8827703b81c
Instruction Fuzzy Hash: 7E419DB1D10309DFDF14DF99C884ADEBBB5BF48350F24812AE419AB250D7719985CF91

Function 06A911C8 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 06A91289

Memory Dump Source

Source File: 0000000C.00000002.4727029481.0000000006A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6a90000_GamePall.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 965f502804d6818533d32a00eb6360218e69edaa7cdc2e74db1d65bb4108f810
Instruction ID: 8ca1dc71b3f07fa6a6661c358d952e1b2a1f7264641e4175aa733c49ca218f1d
Opcode Fuzzy Hash: 965f502804d6818533d32a00eb6360218e69edaa7cdc2e74db1d65bb4108f810
Instruction Fuzzy Hash: 1F413DB8900349CFDB54DF99C488AAABBF5FF89314F24C499D519AB321D335A841CFA0

Function 059FCD48 Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

Xbq, xrefs: 059FDCF1

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID: Xbq
API String ID: 0-63242295
Opcode ID: e1561ff40a330273ce7549ed719901aae289bc139d39be58cd86fb990f3bf3e3
Instruction ID: 231812006633d6dce303760431bd49074d688dfcb8fb907d1892ed3fb3244e76
Opcode Fuzzy Hash: e1561ff40a330273ce7549ed719901aae289bc139d39be58cd86fb990f3bf3e3
Instruction Fuzzy Hash: F7E10734A04219DFCB18DF59C4889A9BBF6FF89341F5584A5E90A9F224D730EE85CF90

Function 0256D630 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0256D6BF

Memory Dump Source

Source File: 0000000C.00000002.3447496175.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2560000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: cf513173b7c84e856dfe1f914ad9bccd827eaeb8d0db4679f12d56d88e9fc7bc
Instruction ID: 4b34fb153ec95e6ceb9f226534399a2fb906b2578bb2577b2331c13fb51c4b7f
Opcode Fuzzy Hash: cf513173b7c84e856dfe1f914ad9bccd827eaeb8d0db4679f12d56d88e9fc7bc
Instruction Fuzzy Hash: EE2116B5900208DFDB10CF9AD584ADEBFF4FB48310F14841AE918A7310D3789944CF64

Function 0256D638 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0256D6BF

Memory Dump Source

Source File: 0000000C.00000002.3447496175.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2560000_GamePall.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 49e779b6b11e3407a842eb5794b38612cc9879f70a1d1eed6098d299ad420878
Instruction ID: 66749a8462eb83085970b1abe7e207f6d645b17a0d5ed93b91f33298e9d7e98f
Opcode Fuzzy Hash: 49e779b6b11e3407a842eb5794b38612cc9879f70a1d1eed6098d299ad420878
Instruction Fuzzy Hash: 8821E4B5900258DFDB10CF9AD984AEEBFF4FB48320F14841AE918A3350D374A940CFA5

Function 0256D1CC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0256E090

Memory Dump Source

Source File: 0000000C.00000002.3447496175.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2560000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 1b2d9912719db8c3331b808dc5539305dc3db4cd16fc86b4d31d0aa6e50e8519
Instruction ID: b41f5a492cdf0c1d55fb47f3b7734346290d7dbc19a813b98dde66dd6c3f07c6
Opcode Fuzzy Hash: 1b2d9912719db8c3331b808dc5539305dc3db4cd16fc86b4d31d0aa6e50e8519
Instruction Fuzzy Hash: 501176B5900648CFCB20CF9AC849BEEBFF4FB48320F108469E958A3250D374A944CFA4

Function 0256E020 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000057,00000000,?,?), ref: 0256E090

Memory Dump Source

Source File: 0000000C.00000002.3447496175.0000000002560000.00000040.00000800.00020000.00000000.sdmp, Offset: 02560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_2560000_GamePall.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 55a7cceb6d85db81b31c9e0950ec108784dcdd22c204036f37c25f8a10bd3414
Instruction ID: de3722ffe9df358736737729f3eaf85a1f7847dac5d3863b0c076c4145fc6f0e
Opcode Fuzzy Hash: 55a7cceb6d85db81b31c9e0950ec108784dcdd22c204036f37c25f8a10bd3414
Instruction Fuzzy Hash: 781137B6900249CFDB20DF99C545BEEBFF4FB48320F208429E558A7250D375A944CFA4

Function 61D341A0 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,69DFF0BA), ref: 61D341BE

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061D34000.00000020.00000001.01000000.00000015.sdmp, Offset: 61D34000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61d34000_GamePall.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 35e10335c14be9930f81ffdcaad44f7ab67a9c9739d5f696bf545c761a20670a
Instruction ID: bce9ca8f182ad785ca413e39bca740ce9d1c2a4f9ab93e28f3698b5de443cbc5
Opcode Fuzzy Hash: 35e10335c14be9930f81ffdcaad44f7ab67a9c9739d5f696bf545c761a20670a
Instruction Fuzzy Hash: 3AF0AFB1304211AFAB009F75DD84E6B3BACFB972527024A2AFC05C3200DB79EC008770

Function 61CE0C40 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

PUU, xrefs: 61CE0FA9

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061CE0000.00000020.00000001.01000000.00000015.sdmp, Offset: 61CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61ce0000_GamePall.jbxd

Similarity

API ID:
String ID: PUU
API String ID: 0-1328610248
Opcode ID: ae36cd75743861f939b56f37e0ea784d00ae6401e9f459dfcbd9b2abab51ff7b
Instruction ID: 261e0f76ec81097ad1b43aada4822f3baa18dc76f73716ac8c492179e800acbf
Opcode Fuzzy Hash: ae36cd75743861f939b56f37e0ea784d00ae6401e9f459dfcbd9b2abab51ff7b
Instruction Fuzzy Hash: C0A1BD71700605CFDB108F65C899A6EBBB2FF85314B208929D45ADB694EF31F921CBD2

Function 06888610 Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06888760

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: 1a141eee4010b9f60d27ac93131a6edd0f77a344a3bc1ea9194ca21c7b1fef86
Instruction ID: 4238aabcd6945a59321a9d8abd1f8f792cdc63a5a7cb9df1fcbf5e129e241d39
Opcode Fuzzy Hash: 1a141eee4010b9f60d27ac93131a6edd0f77a344a3bc1ea9194ca21c7b1fef86
Instruction Fuzzy Hash: D3617D75A00109DFDF44EF64C890AAEB7F6FF88300F548669EA05DB256DB31E945CB90

Function 0688E410 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

%#l^, xrefs: 0688E627

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID: %#l^
API String ID: 0-3776100006
Opcode ID: a6d521e64c21131334d86afcff1a7d9375c856a9534e496fc60d02d358396892
Instruction ID: 41d9c792164847a006041b651f377668910d99cb7913fe88a54c85142af18521
Opcode Fuzzy Hash: a6d521e64c21131334d86afcff1a7d9375c856a9534e496fc60d02d358396892
Instruction Fuzzy Hash: 436183382007409FD366EF38D994A19BBF2FB89314B0585A9E549CB376EB34ED45CB90

Function 0688B780 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0688B8B4

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 52a6f0dbd0c43875b9c29879e87a10c9632ef19b49364a15545def22014552e2
Instruction ID: 1ac84a57e75740029bc7674cc5ff75ddb682c8283410380785df0838a080a924
Opcode Fuzzy Hash: 52a6f0dbd0c43875b9c29879e87a10c9632ef19b49364a15545def22014552e2
Instruction Fuzzy Hash: 1831CE35B002448FC785EB79D860A2EBBF6FFD5300B2584AAE045DB392CE359D02CB91

Function 06888600 Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

4c^q, xrefs: 06888760

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID: 4c^q
API String ID: 0-396817635
Opcode ID: bb17269a9336cbd1b2121d89fd054ab790e67c8e8eefc9974820750caf5dd5c6
Instruction ID: 7d65a13f3f77762a4427013d1a9ba19279ee01efaa94583f4ae3d7e3427f387c
Opcode Fuzzy Hash: bb17269a9336cbd1b2121d89fd054ab790e67c8e8eefc9974820750caf5dd5c6
Instruction Fuzzy Hash: 9F318D75A00105DFDB94EF58C890AAEB7B6FF88300F54826AE905DB292D771EC45CB91

Function 63CE10B0 Relevance: .5, Instructions: 523COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063CE1000.00000020.00000001.01000000.00000015.sdmp, Offset: 63CE1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63ce1000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36e3d773647880db5b2940f4081cd27e8058b00963abfdf2e56aaefe293756f3
Instruction ID: 93c333e2ebb9ce444187069c10dca023a9bf40d9ff6fc431fb38b79d7b5ce5fe
Opcode Fuzzy Hash: 36e3d773647880db5b2940f4081cd27e8058b00963abfdf2e56aaefe293756f3
Instruction Fuzzy Hash: 4302E371A042559FEB04CF5DC880A5ABBB5FF45B14B1881A9F819EF301FB32E852CB91

Function 6201E98F Relevance: .4, Instructions: 355COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.000000006201E000.00000020.00000001.01000000.00000015.sdmp, Offset: 6201E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6201e000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e63a8953f82ce09b1b7824d181526e347e14edce605aee563c5a828700f8ed2a
Instruction ID: d28fc3132714a37b8c8163ec73bd98900a1c18af92904ab221e69e5428f56313
Opcode Fuzzy Hash: e63a8953f82ce09b1b7824d181526e347e14edce605aee563c5a828700f8ed2a
Instruction Fuzzy Hash: 66C134B1E042596BEF10DFE4EC94BAEBFB2AF8070CF444029E8066B241DB716905D792

Function 63571082 Relevance: .3, Instructions: 304COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063571000.00000020.00000001.01000000.00000015.sdmp, Offset: 63571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63571000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d370a90228cfcaf4da3784c142b44944fe54fe230a8e3eb37d240da750c50567
Instruction ID: 0ae9abe0fbe9dc5320bd965a5e691442ade5621212a6336d2fc7b113767d5667
Opcode Fuzzy Hash: d370a90228cfcaf4da3784c142b44944fe54fe230a8e3eb37d240da750c50567
Instruction Fuzzy Hash: 9FC1F272B00A019FD718CF29D890BEAB7F6FF85314F19866DE91997791D734A901CB80

Function 63CA4A50 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063CA4000.00000020.00000001.01000000.00000015.sdmp, Offset: 63CA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63ca4000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde7a647354ceee8f528be2cb3baeab6b8f80c1b8aa05bb85453e4248fe7bc29
Instruction ID: 3377d04d39342c3fb1cc997d8e1bf0b4754b112e158cc9e1940493aee4f807cd
Opcode Fuzzy Hash: fde7a647354ceee8f528be2cb3baeab6b8f80c1b8aa05bb85453e4248fe7bc29
Instruction Fuzzy Hash: B4B18D70A043069BD701DF28C880A5AB7F5FF8AB08F054969F999DB351FB31E945CB92

Function 63D371BD Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063D37000.00000020.00000001.01000000.00000015.sdmp, Offset: 63D37000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63d37000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21673d72bdaa6eb5c0b68d887648b83630b8e954de1741651052b05af93a40a
Instruction ID: d77726e248612ab966cb9e89873c25b7650edafb9c1df4822125d41f70cd4186
Opcode Fuzzy Hash: c21673d72bdaa6eb5c0b68d887648b83630b8e954de1741651052b05af93a40a
Instruction Fuzzy Hash: 2BB19CB5A04B11EFD714CF28C590A1AB7F1BF4AB18F054A2DE8AA87B41D730F954CB91

Function 059FCD38 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62c4407510966e5d8839f7c335905bf297c13a1bf7e4936958f336bfa0cd7b74
Instruction ID: 60ee339554d60ae26285d48dccd30c7ccc8aab01073cca7413f3a02ace7bd61f
Opcode Fuzzy Hash: 62c4407510966e5d8839f7c335905bf297c13a1bf7e4936958f336bfa0cd7b74
Instruction Fuzzy Hash: 47C1D434A04218DFCB18DF59C4889A8BBF6BF49345F5584E9E90A9F264D730EE85CF90

Function 6359720D Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063597000.00000020.00000001.01000000.00000015.sdmp, Offset: 63597000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63597000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c574351dd16ef0a4fa1bd918f14d2cbc6a9c5117fee3c14673334e43d025fd49
Instruction ID: e0b779a84deb49048883e25305a36eaf9c2dea8b74378686f0b8d3452dccdd98
Opcode Fuzzy Hash: c574351dd16ef0a4fa1bd918f14d2cbc6a9c5117fee3c14673334e43d025fd49
Instruction Fuzzy Hash: 6CA154346083809FEB15CF14D194A5EBBF2BF8AB14F08485EF89957391C771AD49CB82

Function 623BA800 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.00000000623BA000.00000020.00000001.01000000.00000015.sdmp, Offset: 623BA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_623ba000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6931a48bb8a7ec195192f4eb740cd6192570b046c468551077e7a0dc46973373
Instruction ID: 9774a0735daa5db0392a8ce1ee3decae0864408e744675f00b253c8998e37b9c
Opcode Fuzzy Hash: 6931a48bb8a7ec195192f4eb740cd6192570b046c468551077e7a0dc46973373
Instruction Fuzzy Hash: 9B51F771704B089FE714CF24C860B2A77B5FF9631AF15491DD56A8BA81E732E902C7D2

Function 068827C8 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef04fa40c8b3daa50ba3816b857045e9c24840a12bb364a632a99a9099cc0635
Instruction ID: a0a7c619ddd24257c76877c0701d42b96acae006e62856eeb8288c2ee21af7f5
Opcode Fuzzy Hash: ef04fa40c8b3daa50ba3816b857045e9c24840a12bb364a632a99a9099cc0635
Instruction Fuzzy Hash: 9E71923070021ADFCB45EF68D8948AEBBBAFF98301B108469E606C7355DB34DE46CB90

Function 619D7D66 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.00000000619D7000.00000020.00000001.01000000.00000015.sdmp, Offset: 619D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_619d7000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a25e17105c9405d17e22e5aa6b368483b3df63ec54533ed898bf6ee39554c1dd
Instruction ID: 1aa0e46ccd8e994f92fe5fb1fece1b9c8659bb36fdaa844e792a5384d9bf3cd2
Opcode Fuzzy Hash: a25e17105c9405d17e22e5aa6b368483b3df63ec54533ed898bf6ee39554c1dd
Instruction Fuzzy Hash: 07617E7190070AAFDB14DF65C881AAEBBF4FF99308F00891DF446A7250EB30A945CBA0

Function 06881730 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b333152ae182fa65ba67eefb882e93c6aca94d418fafd2cc798302c5c64276e8
Instruction ID: 10131e468959c3cc8a167b9053aba42d5118e8029e76cc023bd01a643c5871dd
Opcode Fuzzy Hash: b333152ae182fa65ba67eefb882e93c6aca94d418fafd2cc798302c5c64276e8
Instruction Fuzzy Hash: 1E516A35B60215CFCB48EF69D8498ADB7B6FF89B5171180AAE506CB361DB30EC05CB90

Function 06886688 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc380d84ab64a09c3709bfe2c49d81682e0e4f7ea007873c5e23f67c5cd2862
Instruction ID: 5525e9dfb3524be1188de76688b0c1ddac81641c8c43ce3194afacefa89e0506
Opcode Fuzzy Hash: 2cc380d84ab64a09c3709bfe2c49d81682e0e4f7ea007873c5e23f67c5cd2862
Instruction Fuzzy Hash: B3417632B042608FCB64BB6DE88047EBBF5EFC5751B15417BE685C7241EA259C81C7D1

Function 63D37444 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063D37000.00000020.00000001.01000000.00000015.sdmp, Offset: 63D37000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63d37000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713f201286dfc9a4b98cc07cc77ac233a1326c36d09f5c1a056ab0b6b79a42d8
Instruction ID: 02c4fdb2fa9527256e1d790c1adf6fbbcc85e293c2c24dbb19b8ba8247243f00
Opcode Fuzzy Hash: 713f201286dfc9a4b98cc07cc77ac233a1326c36d09f5c1a056ab0b6b79a42d8
Instruction Fuzzy Hash: FC6165B0600B01EFD724CF28C594A56B7F1FF49B14B148A2DE8AA87B91D730F865CB90

Function 619D7DD0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.00000000619D7000.00000020.00000001.01000000.00000015.sdmp, Offset: 619D7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_619d7000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d4c78849fa575634aa3cb557faaa736f112bba4cf16ebeae9377429d9215836
Instruction ID: 16c7d37fcf48fbac13938aaaec9057c0262f98c393b6750192d9fa93ceb98cca
Opcode Fuzzy Hash: 9d4c78849fa575634aa3cb557faaa736f112bba4cf16ebeae9377429d9215836
Instruction Fuzzy Hash: E0516F75D0060AAFDB04DFA5C891AEEBBB9FF95718F008519F406A7240EB34B955CBE0

Function 63C58DE0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063C58000.00000020.00000001.01000000.00000015.sdmp, Offset: 63C58000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63c58000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2a87196a92214de7f62c37d30cf78b9d3fd7ea3d98adcc985499ba9cee3621
Instruction ID: 02c75946733d104d5269e250dd8abdefb1d7b7a23cad79ee0bcdd73a00b0c6fc
Opcode Fuzzy Hash: 1a2a87196a92214de7f62c37d30cf78b9d3fd7ea3d98adcc985499ba9cee3621
Instruction Fuzzy Hash: BB5113B16083008FC704DF28C49061EBBF5BF89A24F454A2DF896DB351EB34E959CB86

Function 61E75B00 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061E75000.00000020.00000001.01000000.00000015.sdmp, Offset: 61E75000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61e75000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5872468f4ae31c4d06e29d391ab7083f4b00ac235f8d18c7740df538026af360
Instruction ID: 8b731f6b2af6a2e5a2cd418f8fee022bb3031213efb6f85821d9d270ed4e76fe
Opcode Fuzzy Hash: 5872468f4ae31c4d06e29d391ab7083f4b00ac235f8d18c7740df538026af360
Instruction Fuzzy Hash: BE517471D052699BEB21CF21CD48B9EBBB9EF96308F2082DAE44D66101DB719AC5CF41

Function 61DA3D50 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061DA3000.00000020.00000001.01000000.00000015.sdmp, Offset: 61DA3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61da3000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029cffc8973ac6aa0d2658e6727707cc1512d5731325fb3e20d6bb1886f735d8
Instruction ID: feae3f93bab3790139b5314b0e99615d4bdce3b01e3425e46487244d9e1ec272
Opcode Fuzzy Hash: 029cffc8973ac6aa0d2658e6727707cc1512d5731325fb3e20d6bb1886f735d8
Instruction Fuzzy Hash: 30415571A08345BFEB04CF58C850FAFBFB6AF85B18F48C219E9456B251DB309A06C791

Function 61DA3D37 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061DA3000.00000020.00000001.01000000.00000015.sdmp, Offset: 61DA3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61da3000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ad277d2f3fa479916d1588e6ccd5f4cbcefbd9c0088bec2012ceb9d086238a
Instruction ID: 33734d6e6a504a03ff6b5aef1fae81171a3d60a6012559b6f93fe3185b745f80
Opcode Fuzzy Hash: e1ad277d2f3fa479916d1588e6ccd5f4cbcefbd9c0088bec2012ceb9d086238a
Instruction Fuzzy Hash: 09417831908345BFDB0ACF58C851BBEBFB6AF85318F04C25DD8555B2A2D7708A16C791

Function 620363A0 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000062036000.00000020.00000001.01000000.00000015.sdmp, Offset: 62036000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_62036000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47b5627d445958ebff1879061bd68ce467ec7a554c24eb1f89deef843e8bf3e
Instruction ID: 6ac1b3f5864d8c44e88d4379593b125f1a934b959c4d60cdde52e97b9f71c848
Opcode Fuzzy Hash: b47b5627d445958ebff1879061bd68ce467ec7a554c24eb1f89deef843e8bf3e
Instruction Fuzzy Hash: 4F417B70A0031A9FDB15CF25C990BABBBF5FF88718F10841EE91A9B245D770E811DBA0

Function 059FF29F Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc2e30c967f0ceff020708207412235380770fcd6a86d212af33a3aa7540732
Instruction ID: 2c5640d887fa1e7e43646b23eb3b434cf6ee845b729a35951486fd075816e5f6
Opcode Fuzzy Hash: 1dc2e30c967f0ceff020708207412235380770fcd6a86d212af33a3aa7540732
Instruction Fuzzy Hash: 0E413935B101008FCB44EF68C598A6DBBE6FF89714B6980A9E506DB3B6CB75EC05CB50

Function 059FF2B0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fab7967929327dddf7a4c9084829987c8eae2182d5ba5c398012ecd10d1572
Instruction ID: e2d5d2c17c6593fc79ef4d4588a10f6b21075bf77284f88848de004273558aeb
Opcode Fuzzy Hash: a8fab7967929327dddf7a4c9084829987c8eae2182d5ba5c398012ecd10d1572
Instruction Fuzzy Hash: 47412534B101008FCB44EF69D498A6DBBE6FF89714B2980A9E506DB3B6CB75EC05CB51

Function 06885700 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca83c33dd9f05f88211244958446cc47bc3c275a008a848089fc45f5b3503fb9
Instruction ID: 391787f43a8608f6e80dcb4f93611ce15e32097d465f06c7170701bc0dd8cddb
Opcode Fuzzy Hash: ca83c33dd9f05f88211244958446cc47bc3c275a008a848089fc45f5b3503fb9
Instruction Fuzzy Hash: DC41C331A64249CFDB80EB28C8947FEBFB1AF49304F0881A9D106EB392C6759D44CB61

Function 63CC7C65 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063CC7000.00000020.00000001.01000000.00000015.sdmp, Offset: 63CC7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63cc7000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a8a17d33a05ce7fe76aff6224e59ba74c346d9aa1b3fd1deccc39a742360fb4
Instruction ID: c5acfdafa098e56fab5c895e4a5b6e34c5704cbef4a4368ed69d47eb5edfa9b6
Opcode Fuzzy Hash: 8a8a17d33a05ce7fe76aff6224e59ba74c346d9aa1b3fd1deccc39a742360fb4
Instruction Fuzzy Hash: F741C371A04B408FCB20DF29C490A1ABBF1FF46B18B00895DF896CB651E734F844DB52

Function 059FBFC7 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1278b89ce76024674301e1ed4387af57c839fa93bb972edaafc5d3bce7763af7
Instruction ID: 9ad19ae111137b19881f59faffc377e6198c039141f139767a0872386f754023
Opcode Fuzzy Hash: 1278b89ce76024674301e1ed4387af57c839fa93bb972edaafc5d3bce7763af7
Instruction Fuzzy Hash: 2231A235E042169FCF10DF68D8809AAFBB1FF49320B1585A9E529EB251D331ED42CF80

Function 059FFAF4 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f82de86e5db42728ee68cb8c9f65a3da599a9a92c54d252dcf0f0e14989c2d
Instruction ID: 366c433d49cc9686ea6491b11524e989db197dbececca8e450eb5067e1d12c65
Opcode Fuzzy Hash: d9f82de86e5db42728ee68cb8c9f65a3da599a9a92c54d252dcf0f0e14989c2d
Instruction Fuzzy Hash: 2F41E3B1D012489FCB14DFA9D595ADEFBFABF48304F24802AE409BB250CB749945CF95

Function 059FF154 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a73f93b473cb647a35f7109df434999c2b8e6c69eb7a61b7a5c6c4176b545664
Instruction ID: e940f4047af5fc662b2aa9ba03e693a6ab1bef0dd8046435e12c142b2e2725d5
Opcode Fuzzy Hash: a73f93b473cb647a35f7109df434999c2b8e6c69eb7a61b7a5c6c4176b545664
Instruction Fuzzy Hash: 8441F2B1D01258DFCB14CFA9D985BDEBBFABF48304F24802AE405AB250DB75A945CF94

Function 059FFB00 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c9cfe9bcf1592d02fd60a3dec153e51ae1cd65a08e130fd29ff06ea8a71684
Instruction ID: e9eac9bad3d0452cd0d76b3cd99a8e027eaf5cbaac43a6e9a6fe5dd245468922
Opcode Fuzzy Hash: 49c9cfe9bcf1592d02fd60a3dec153e51ae1cd65a08e130fd29ff06ea8a71684
Instruction Fuzzy Hash: 0941D2B1D012589FCB14DFA9D594ADEFBFABF48304F24802AE409BB250CB749945CF54

Function 059FF99C Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb53fbbb7ca0da395a61961d9d6208e12ce25651ef91e58fa9241c905e4021d8
Instruction ID: 9f28bb024a03f260136bb4d507bf6b16ef167af531b9c0d22c9885c735c21e00
Opcode Fuzzy Hash: fb53fbbb7ca0da395a61961d9d6208e12ce25651ef91e58fa9241c905e4021d8
Instruction Fuzzy Hash: 704115B1D01248DFCB14DFA9C984BDEBBF6AF88304F14802AE505BB250DB749945CF61

Function 059FF9A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c680fc3183cd655ad5296c79c82567ba95df47aeb4cdc39ec9af9d07a0c95b69
Instruction ID: 9931f816ee0e447c5f87bb6f6fc87cb76a097ea8a2ea5930f4d1b5943d496c19
Opcode Fuzzy Hash: c680fc3183cd655ad5296c79c82567ba95df47aeb4cdc39ec9af9d07a0c95b69
Instruction Fuzzy Hash: 2B31F5B1D01258DFCB14DFA9C984BDEBBFAAF48304F14802AE505AB250DB749945CFA5

Function 059FF160 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c3e87a9cbfee328f39981347b528e49dc87fa942d24fcb5a821f62448a9b14
Instruction ID: df257e806d738ab998361b06cdfa99b6641043b9ad0e3097591d54af190c2d35
Opcode Fuzzy Hash: 79c3e87a9cbfee328f39981347b528e49dc87fa942d24fcb5a821f62448a9b14
Instruction Fuzzy Hash: 933100B1D01248DFCB14CFA9C984BDEBBFABF48304F24802AE409AB290DB745945CF94

Function 61CE0B40 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061CE0000.00000020.00000001.01000000.00000015.sdmp, Offset: 61CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61ce0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1586aba6e1b49a8676edd8b9693e0b7476ef3f7ff3ab1874307f1d54166a456e
Instruction ID: ce665295a12cafa4dd81794796dd6b8ffb073d0b49d3c76265907b7466259059
Opcode Fuzzy Hash: 1586aba6e1b49a8676edd8b9693e0b7476ef3f7ff3ab1874307f1d54166a456e
Instruction Fuzzy Hash: 552103366047099BCB00CF24C884A9EBBB1FFC9358F05852DE85A8B241EB30E954CBC6

Function 63597607 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063597000.00000020.00000001.01000000.00000015.sdmp, Offset: 63597000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63597000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730af674839f4f56c2377b386d575ae299adccd028f04495189dafc98c7b8d67
Instruction ID: bac15df26b90a311d0fb63c3793688897eabe65c5422eff0ed34057f35057db5
Opcode Fuzzy Hash: 730af674839f4f56c2377b386d575ae299adccd028f04495189dafc98c7b8d67
Instruction Fuzzy Hash: DE214D319087959BFB22DE10E54079EBBF4AF84B54F09094EFC95672D1D730A949CB82

Function 09AC3104 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c27afbe9cc618e7daa131c725197695826217a8ec511729b3cc189d95a41aaf2
Instruction ID: e8738d729acf1e04d6e4d49fad6fb6a357718a5063c16f5b9418656a45cc3a79
Opcode Fuzzy Hash: c27afbe9cc618e7daa131c725197695826217a8ec511729b3cc189d95a41aaf2
Instruction Fuzzy Hash: 572121B1600200EFCF05CF54D9C4B26BFA5FB88714F20C5ADE90A4E25ACB36D45ACBA1

Function 09AC2F2C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2a960545bce5fdf64c726b5dee335e8db35261b720027ba38dcd8dc6f870cc6
Instruction ID: c6febc7d37d1a0ffe90d928ae5e8dae0ffa02547f3e898a9de05e322448caf25
Opcode Fuzzy Hash: d2a960545bce5fdf64c726b5dee335e8db35261b720027ba38dcd8dc6f870cc6
Instruction Fuzzy Hash: AB21D1B1504208DFDB05DF14D984B16BB65EB88B14F20C56DED094E356C736D856CAA1

Function 09AC3AA0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625d94b0956b5b4ea4fff7d42bf9c6dc99361770232b7528942f6cee21c15d1a
Instruction ID: 02f9398478fdbfb337eaff1c4099337b7862de7c4c1ddb2fd66178af865b9cf8
Opcode Fuzzy Hash: 625d94b0956b5b4ea4fff7d42bf9c6dc99361770232b7528942f6cee21c15d1a
Instruction Fuzzy Hash: A22103B1504240EFCF04DF14C5C4B26BB65FB88B14F20C56DE90A4F252CB37D456C661

Function 61E5A6A0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061E5A000.00000020.00000001.01000000.00000015.sdmp, Offset: 61E5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61e5a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f15ed047516aa050cdd3e6c7398d2dd3b96e9b015e919675ea54518f0a1068cb
Instruction ID: f681d5b21a09cf5d256fdc757c16e2ee6d0dc95ae675437ff4a834a59ba37f6e
Opcode Fuzzy Hash: f15ed047516aa050cdd3e6c7398d2dd3b96e9b015e919675ea54518f0a1068cb
Instruction Fuzzy Hash: 1E21A4B5A002149FDB10CF55D885DAFBBB9EF88718B05842DE9069B311E730E904CBF1

Function 00BED1CC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4042892bad2c6a7dc221576b1a994c008d601e7337d50105dc8b03c0197b523
Instruction ID: 00649900ac6c842ebce0854d17918da5cd2cd61c6571e88b64a9a1367e95fc2c
Opcode Fuzzy Hash: c4042892bad2c6a7dc221576b1a994c008d601e7337d50105dc8b03c0197b523
Instruction Fuzzy Hash: 2B2146B5604384DFDB00DF15C5C0B26BFE5FB84314F20C6ADD9094B296C3B6D846CA62

Function 00BED01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3db4f83e844e1846bc45a0cbe780c4863b997ac9bf22fe336516dac9b7994c22
Instruction ID: 60fefa5bed732335a233b8f71b86e12a58ae568845804e03e9114265aceaf6c1
Opcode Fuzzy Hash: 3db4f83e844e1846bc45a0cbe780c4863b997ac9bf22fe336516dac9b7994c22
Instruction Fuzzy Hash: 93213871504280DFCB10DF15D9D4B26BBE5FB84324F38C5ADD8494B282C3BAD847CA62

Function 00BEE700 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f2f1f8e8634fdbd7f918b0213ee7e1d4087e1b4812f80aa98c6318b442107d5
Instruction ID: 9ab2150cf649a6cad81e9b02aa71f6d4856697dbc2c3741c67ff3598b0ea0d91
Opcode Fuzzy Hash: 9f2f1f8e8634fdbd7f918b0213ee7e1d4087e1b4812f80aa98c6318b442107d5
Instruction Fuzzy Hash: 17214675604280DFCB00DF15D9C0B26BBE6FB98314F20CAADE9094B296C33ADC46CB61

Function 09AC248C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0fe76bb9e16029f1a30e4403d4936b603e05636953358814df491fa05ff4dc
Instruction ID: 34fb33e773ed4df0bab8508cacd348fe43e2b715920fb9667e057518868d4c0f
Opcode Fuzzy Hash: 3f0fe76bb9e16029f1a30e4403d4936b603e05636953358814df491fa05ff4dc
Instruction Fuzzy Hash: EA21F2B5544204EFCB05DF14DA80B27BBA5FB84B14F20C56DEC194F296C73AE446CA61

Function 61E5A693 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061E5A000.00000020.00000001.01000000.00000015.sdmp, Offset: 61E5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61e5a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ff3cac02670714b0e09c3ed381d7913f19412c431b3a178c72ef29a045223b
Instruction ID: 387df4b9f045f893c3b77d037fe046d23ce2584e947e63f210caedfac5a4fe57
Opcode Fuzzy Hash: d0ff3cac02670714b0e09c3ed381d7913f19412c431b3a178c72ef29a045223b
Instruction Fuzzy Hash: 282184B5A00204AFDB10CF95C885DAFBBB5EF88714B01842EE9059B341E730E904CBF0

Function 0688E731 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f3a7078254c05326343b4f11d42a9f97ba6957f6da3c4c302142fde23aca46
Instruction ID: 4e16ff5281050cbf3bc0ab50ea06755b2af0e5be3e5422e2f4a4e43884e5236a
Opcode Fuzzy Hash: 81f3a7078254c05326343b4f11d42a9f97ba6957f6da3c4c302142fde23aca46
Instruction Fuzzy Hash: B6110334B042544FCB10EF7DA4146AFBFFADF89650F1404A6EA88D7342DA619905CBE1

Function 059FFC68 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c0786a728c17eff10862ef95806ae12af56681c6e28e7e01c976ccc26f4ac40
Instruction ID: a3fb9dc31d692e424efb63c48f9b4cfca51a442fe617b5fbd9fcd1e8115c5d79
Opcode Fuzzy Hash: 9c0786a728c17eff10862ef95806ae12af56681c6e28e7e01c976ccc26f4ac40
Instruction Fuzzy Hash: 6C216F32E1071A8BDF15DF95D8505EEF7B6FF85304F14892AE905B7240EBB0A94ACB80

Function 00BEE3B8 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65558e6b9c8daa43e474307185a283d4186f0968d36e474a2c5b5641ab7f1476
Instruction ID: 32c508464173bba27cbafadab62da19a402df82e5f8ae652e4aef6ca522fba2c
Opcode Fuzzy Hash: 65558e6b9c8daa43e474307185a283d4186f0968d36e474a2c5b5641ab7f1476
Instruction Fuzzy Hash: 542105B1604280DFDB05DF15D6C4B2ABBF5FB94714F20C6ADE84A4B391C33AD846C662

Function 00BEFEFC Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7efad8cfb6c040808c65458014c864b9f136e6dd76a371e964f449855e557a1
Instruction ID: 18c22ffcfa77e699c79468870b13a8a6e8c962ad999146d8607dbd0947d8272e
Opcode Fuzzy Hash: d7efad8cfb6c040808c65458014c864b9f136e6dd76a371e964f449855e557a1
Instruction Fuzzy Hash: EF210171605281DFDB04DF14D6C4B3ABBE5EB95314F20C6BDE8094B291C33AD806C6A1

Function 00BEF5B8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80776579933c509d7e80f1b3da73e4a7cfd06fcb5199b4051dbedd9e0704a2ba
Instruction ID: e5873aa7889226e1d5d950ab6f21211327c7b78ec3e60168f8ad35495bb79a39
Opcode Fuzzy Hash: 80776579933c509d7e80f1b3da73e4a7cfd06fcb5199b4051dbedd9e0704a2ba
Instruction Fuzzy Hash: B321F3B16442819FDB04EF25D6C4B36BBE5EB94314F30C6BDD90A4B2A5C33AD846C661

Function 00BEDF98 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdcb6c29ea4007b08d0e6b35d178d51f5f0151dbd5fc6811295b0c03e63256f
Instruction ID: 33275a3b9476d1c933513bf44d2b9c6aa2541a117d47b49142264e5f4c4934bb
Opcode Fuzzy Hash: ecdcb6c29ea4007b08d0e6b35d178d51f5f0151dbd5fc6811295b0c03e63256f
Instruction Fuzzy Hash: ED2157B0604280DFD714DF24D5C4B26BBE4FB94314F30C6ADD80A4B352C3BAD846C6A1

Function 00BEF688 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c10e0c5d31f130125491aae5fff86738a48103aaa7f45d7558c9e434d9389ff
Instruction ID: b54126af2f7245fd1986a7a3055a262fa00115909c5f9b203dd267070bcaa3d1
Opcode Fuzzy Hash: 4c10e0c5d31f130125491aae5fff86738a48103aaa7f45d7558c9e434d9389ff
Instruction Fuzzy Hash: B92132B5604281DFDB04EF24D5C0B36BBE5EB94314F20C6BDD80A4B291C73ADC46C661

Function 00BEF8F8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924d745570714c69590950c744c2fa3736201700fb8459908628ef328a032c45
Instruction ID: a96f5f8b403038af09ab89473b45d2a8b66184fa73eb9cf65aa843ac63b05039
Opcode Fuzzy Hash: 924d745570714c69590950c744c2fa3736201700fb8459908628ef328a032c45
Instruction Fuzzy Hash: 1121F6B5504281AFD704DF25D5C4B36BBE5EB94314F20C5BDD98A4B392C33AD846C6A1

Function 00BEE7E8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3808e476eaedd1792fda6e5831fa3203b3727ec6834147558bfa71913dde4f0
Instruction ID: 92bcdb82c4f3e4724e20dce08da9023130f6cf95867ecd81844debced00fd91a
Opcode Fuzzy Hash: d3808e476eaedd1792fda6e5831fa3203b3727ec6834147558bfa71913dde4f0
Instruction Fuzzy Hash: 242124B1604280DFDB04DF25D5C4B26BBE5EB94314F30C6BDD90A4B391C33AD846C661

Function 00BEF828 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346f9ba60266db24b741611b78eebd19655a7eb921bbbe123dcd38a241b6cef7
Instruction ID: fb65ac929825c529aa9100b918093b565e535a01079757bb52b4aecad4f2f5f5
Opcode Fuzzy Hash: 346f9ba60266db24b741611b78eebd19655a7eb921bbbe123dcd38a241b6cef7
Instruction Fuzzy Hash: 4721F0B1604281DFDB04EF25D9C4B36BBE5EB94314F20C6BDD94A4B291C33AD846C6A2

Function 00BEF278 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f76b078596c9118b8f6f85b461cabb0d46f2efc8814ca97d1e9aaa1208853b1
Instruction ID: ff2da0e4488a453cbabcbd37126e77cf125410d26b0335674eed95a0f75a24e3
Opcode Fuzzy Hash: 7f76b078596c9118b8f6f85b461cabb0d46f2efc8814ca97d1e9aaa1208853b1
Instruction Fuzzy Hash: 642105B5644281DFD704DF25D5C4B3ABBE5EB94314F30C6BDE90A4B291C33AD846C661

Function 00BEEE68 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a2c2411ae7bc4beb6ee8a6477ebd46c2f0ca4b0530b02f8b86374b80c039bf
Instruction ID: de0f857e346e2e6d89312d37c8986a09a642d27f38a98e49929ad2d8d9d70058
Opcode Fuzzy Hash: d3a2c2411ae7bc4beb6ee8a6477ebd46c2f0ca4b0530b02f8b86374b80c039bf
Instruction Fuzzy Hash: D82127B1644280DFD714DF25D5C4B26BBE5EB94314F30C6ADD90A4B395C33AE846C6A1

Function 63C4AC1E Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063C4A000.00000020.00000001.01000000.00000015.sdmp, Offset: 63C4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63c4a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d25798a2c96c8f8eb8be5b3ee299b324d4a40378b9df4da9ef340189cb8f1f9
Instruction ID: 1b3d755263e3645cde9cc8ccc6481f5524e0eb2a348d8413a5635d98a1073a05
Opcode Fuzzy Hash: 8d25798a2c96c8f8eb8be5b3ee299b324d4a40378b9df4da9ef340189cb8f1f9
Instruction Fuzzy Hash: 7B21AC35600B048FD791CF24C5557AAB7F1FF46718F05886DE89ACBA52FB32A849DB80

Function 0688B648 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a373b0d0c63cee904f0bd9b152950ea3f3f6a1c91bd75a5753968f899ab5da
Instruction ID: ab836595166cafecb2ebceec865d12d472a40d57c78287057667aa263d8c2d18
Opcode Fuzzy Hash: 07a373b0d0c63cee904f0bd9b152950ea3f3f6a1c91bd75a5753968f899ab5da
Instruction Fuzzy Hash: B32158306447618FC715DF28D494D5ABBF2EF8531471544AAE242CB772DB32EC44CB40

Function 00BED002 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 096985bd11884b3083e4ecb03e97d5c8f259511b4ce85b1b34a1906e0516f635
Instruction ID: 306750885ee870331f046bd5faadf255be790e406ab6b79e5be0a61380d6f72b
Opcode Fuzzy Hash: 096985bd11884b3083e4ecb03e97d5c8f259511b4ce85b1b34a1906e0516f635
Instruction Fuzzy Hash: 3A2184755093C08FDB12CF20D994715BFB1FB45314F29C5EAD8498B693C37A980ACB62

Function 635713EB Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063571000.00000020.00000001.01000000.00000015.sdmp, Offset: 63571000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63571000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34bde62ac84078a5141a6eca7dd8098e338aef709c6d42c7ba5b3ed29b2da61c
Instruction ID: 8507fee8c508a79fa879eb92235340ed845e530dbb1b2ee03bd89a11d4f0e41f
Opcode Fuzzy Hash: 34bde62ac84078a5141a6eca7dd8098e338aef709c6d42c7ba5b3ed29b2da61c
Instruction Fuzzy Hash: CD110072A00B044FC7188A29DC41BEAB3F6FFD8325F0A853DEA0997391D634A9018B90

Function 09AC30FF Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b29b612565f3c29fca56b7262dcb6e7a6eb5c004aee1e4b425a9623457d3f1c5
Instruction ID: 506382de56d40bd6bd3db7b2eecb2e8e86ba278461a385e6805537333a7cef49
Opcode Fuzzy Hash: b29b612565f3c29fca56b7262dcb6e7a6eb5c004aee1e4b425a9623457d3f1c5
Instruction Fuzzy Hash: 622158B6504240DFCF06CF50D984B16BB62FB48714F24C5A9E9094E26AC33AD46ACBA1

Function 059FCCA8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cadaeb00a73ff1882e6ba275e2e40ef031f9425cf3647f9a562de94e7cff6926
Instruction ID: 4e75cace840b12c9147d35d65f9c265a6513bf08448a6eb92bbc2ca9271a22d5
Opcode Fuzzy Hash: cadaeb00a73ff1882e6ba275e2e40ef031f9425cf3647f9a562de94e7cff6926
Instruction Fuzzy Hash: 7211FA363101149FCB049F59E884D5E7B7AFF88761B148196FA098B375CB72DC51DBA0

Function 09AC2F27 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8584e8b34059ca45f0b9382214227a81a61fed94124399a3e2ed2ae9508f89ab
Instruction ID: 03cc1a8346acb3d168bf186b6928794d1dd7b13a2767d9b481ccf01e98c51e6a
Opcode Fuzzy Hash: 8584e8b34059ca45f0b9382214227a81a61fed94124399a3e2ed2ae9508f89ab
Instruction Fuzzy Hash: E3119AB6504244CFDB06CF14D9C4B16BF62FB84714F24C6ADE90A4E256C33AD85ACBA2

Function 09AC3A9B Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba3ac9388d48d1d0907abc59679f8125cf5a58857ce11d2f015c82d4c6e0e3dd
Instruction ID: a6927900453a3b9ae0729a04b93de3ef22f3fd8a077bcce197ccc6cd0850b350
Opcode Fuzzy Hash: ba3ac9388d48d1d0907abc59679f8125cf5a58857ce11d2f015c82d4c6e0e3dd
Instruction Fuzzy Hash: CC117CB5504280DFDF06CF14D5C8B15BB61FB84714F24C6ADE9094F266C73AD45ACB61

Function 00BEE6FB Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 6bb5c7bcff4ff68efbe8fe20a109fe9cae45968c343923d2cece87ca4f03bd8e
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B111DD79504280CFDB01CF10D5C4B15BFA2FB84318F24C6AADC494B696C33AD80ACB61

Function 00BED1C7 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 174cb50e93820d83c7c873ce2b091d217f2639dd21d6ad09911fd5c1558a4429
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 9511DD75504284DFDB01CF20D5C4B15BFA1FB84314F24C6AAD9094B256C37AD80ACB61

Function 09AC2487 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4740722460.0000000009AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 09AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_9ac0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 7849643482e202f8258a13407e522034cc5a757271ab15480129473591ccb2f0
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: B111BBB9504284DFCB02CF14D5D4B16BBA1FB84714F24C6AEEC094F2A6C33AE40ACB61

Function 00BEE3B3 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction ID: 0fdf290f27d98d2851aa1a81a77d73cf2cd86e74ddeabd8dd5e1e6b04e21c800
Opcode Fuzzy Hash: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction Fuzzy Hash: 96118C75504680DFDB15CF14D6C4B19BBB1FB94318F24C6AED8494B792C33AD84ACBA2

Function 00BEFEF7 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction ID: b4e874c4fbfcc47cfa4320090c3cb5c2549bd122933b410f00ac6f510506f551
Opcode Fuzzy Hash: 04ca03276ac0ccff4c81988cf554042a47405952ec31bc816ea136efef3652f3
Instruction Fuzzy Hash: E711BC75505280CFDB05CF14D6C4B26BFA1FB95318F24C6AEE8494B692C33AD80ACB92

Function 00BEF5B3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: b6f68566722713a0a5e3c2286ebdffc5e433564a8035f8a91a292bc0472dd85d
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: F211CE755042808FDB05DF24D5C4B25BBA1FB94314F24C6BEC8494B6A6C33A984ACB92

Function 00BEF683 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: e4d6257fea65aa3b208bf11c936098481354133ad2902f93e1792a8f9a5d9c7c
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: F2119EB55046808FDB15DF24D5C4B25BBB1FB94314F24C6ADC8494B652C33ADC4ACB92

Function 00BEF8F3 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: 3f3fc961c4858ecc1cbcc9c264f8c8f742f342a9c77ae9f372c264970819a8e7
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: C7119EB95046809FDB15DF24D5C4B25BBA1FB94314F24C6ADC8894B792C33AD84ACB92

Function 00BEF823 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: 8d2d9448e3724137b2bbb623283bc995c454cd3d429112f4167bd7f8e539894d
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: 20119E75904680CFDB15DF24D5C4B25BBA1FB94314F24C6FEC8494B692C33AD84ACB92

Function 00BEF273 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: 7921ba3be14df14084d84dfbeee92a47b0720edf508009348ff1c38150ecd8a5
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: 9C11A0B5504680CFDB15DF24D5C4B29BBA1FB94318F24C6BEC84A4B652C33AD84BCB92

Function 00BEEE63 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.3446949998.0000000000BED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_bed000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction ID: ebc62617e0e8b2ab042d8b4a92cc811420d61d17c5783322549fcc817b5f8dad
Opcode Fuzzy Hash: a92e343b2ec8107a1b7e7b4a0bdf893b5718a373afcbc14ce15bd6b9ac5bef1e
Instruction Fuzzy Hash: 4D11E075504280CFEB15DF14D5C4B15BBA1FB94314F24C6ADD84A4B752C33AE84ACB92

Function 635973CB Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063597000.00000020.00000001.01000000.00000015.sdmp, Offset: 63597000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63597000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5490ab72da32aef438f5fde4701865b2b69f4c9ae01c492549007d36dc84322e
Instruction ID: ca148b5f06a19e9f5959478bba90cc9d0d5dee73752ec488531d171ed125b5d5
Opcode Fuzzy Hash: 5490ab72da32aef438f5fde4701865b2b69f4c9ae01c492549007d36dc84322e
Instruction Fuzzy Hash: 7411C03190C3C69FEB15CF10E09079DBBA0EF99B58F08089AED95572D2DB20AD49CB42

Function 059FEEE0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ed860dd0c289bdfe9793b51b8384f7b8d199c98a1445ea813f1d1c542e29e2
Instruction ID: 3f0efafe6cc52d908cd6f146c7b33bef879195e0d93e1bcc9c4ecbb9f63047c2
Opcode Fuzzy Hash: b4ed860dd0c289bdfe9793b51b8384f7b8d199c98a1445ea813f1d1c542e29e2
Instruction Fuzzy Hash: ED014C3A300614AFC7089F65E85896ABB6AFF88315B158469F906C7365CB31EC42DF90

Function 63CA49CD Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063CA4000.00000020.00000001.01000000.00000015.sdmp, Offset: 63CA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63ca4000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb1a2a2ce8449a36a27e1a7121c920adac8053a7944db3b4b024b4915f800eed
Instruction ID: 56eaa97fa420b21f5f57835343743369ff090cce7374bfdb2634ea9097f19ce6
Opcode Fuzzy Hash: bb1a2a2ce8449a36a27e1a7121c920adac8053a7944db3b4b024b4915f800eed
Instruction Fuzzy Hash: F5012136200B088FC310CF19E980C97B7E5EF85B64B15850EF89A87700EB30F810CBA4

Function 63CA49D0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063CA4000.00000020.00000001.01000000.00000015.sdmp, Offset: 63CA4000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63ca4000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e5c412a63c06ca24a1f9f29625a8e446122554c0f8e087a84caaa62dbf651f
Instruction ID: 569ff8b144e0d52d9bd40b99d3491eebeab482af8088b5b99a4802c61f785726
Opcode Fuzzy Hash: 07e5c412a63c06ca24a1f9f29625a8e446122554c0f8e087a84caaa62dbf651f
Instruction Fuzzy Hash: 8101F2362047058FC310CF29D980887B7E5EF85B64B05851EF89A87300FB30F810CB64

Function 059FDE4A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec71489fb5eb35a69b28714e0f1422843e0f9af783368976c3b7ffd962bb2be5
Instruction ID: b58c1b38bd3bf7b7127bf29312f905af0dbc803d8e81fd95082ab89c780dab5a
Opcode Fuzzy Hash: ec71489fb5eb35a69b28714e0f1422843e0f9af783368976c3b7ffd962bb2be5
Instruction Fuzzy Hash: 54F0A472504320AFD7244A46DC84F77BBEFFB94711F04882EF78682641D675E815D7A0

Function 63C6A400 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063C6A000.00000020.00000001.01000000.00000015.sdmp, Offset: 63C6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63c6a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fa1ce0381c67100728027fc19c75b2e2108d3ef6dce288e5061122e8be6cf7
Instruction ID: 3bfb2f9eb49f1d7e3735ec1dc2949f351e3628210ca41870ccf99554244c4b01
Opcode Fuzzy Hash: 52fa1ce0381c67100728027fc19c75b2e2108d3ef6dce288e5061122e8be6cf7
Instruction Fuzzy Hash: 9A014C71A047089FC700DF29D49465EBBE4FF89324F008A2EF8999B240DB30A958CB96

Function 63597636 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063597000.00000020.00000001.01000000.00000015.sdmp, Offset: 63597000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63597000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b6bc08ac2499a302851648e6fefade4b819a64d3a193a74215c931efeea9c95
Instruction ID: 8798f612960170a548a6d62fd359922d77eed884e06e9992b892ec55c829dc08
Opcode Fuzzy Hash: 1b6bc08ac2499a302851648e6fefade4b819a64d3a193a74215c931efeea9c95
Instruction Fuzzy Hash: D001D4719082859FEB01CE10A09039DB7A4EF89B14F04045EEEA4172C2CB30AD09CB82

Function 63597EC5 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063597000.00000020.00000001.01000000.00000015.sdmp, Offset: 63597000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63597000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8045a4a0277d554bd18ee7f281c0d48843f97ea2e301f02b0410d17cb120ebe3
Instruction ID: ab51f5dbd46c603fef32e0ba5b53064a0a1786cc09afad33eb910414cc53c15d
Opcode Fuzzy Hash: 8045a4a0277d554bd18ee7f281c0d48843f97ea2e301f02b0410d17cb120ebe3
Instruction Fuzzy Hash: 7E01B974609380AFD701CF18C494A5ABBB2FF8A748F15494EE8989B391C771E842CB92

Function 0688E670 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b996b33f2fb9af4d46b5f9dd25c1938f308c30dab91ac6453cce98e23bbddcf
Instruction ID: 48d22b4195143d1231171176099827f5030082c8bbc515c0f5461ffe82eda4bd
Opcode Fuzzy Hash: 1b996b33f2fb9af4d46b5f9dd25c1938f308c30dab91ac6453cce98e23bbddcf
Instruction Fuzzy Hash: A20119B1A043548F8794DF2ED88085AFBE5FF8D61034142AFEA49CB722D770A941CBA5

Function 059FDE58 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6cc573d12d7c49f1f10f56f71d12fdda361c8a134b03fe738ee053fffb3d19
Instruction ID: 2b645b9464631074b11de0248d78c9962aba1b8a4684f00b63e271c8bb637158
Opcode Fuzzy Hash: 4a6cc573d12d7c49f1f10f56f71d12fdda361c8a134b03fe738ee053fffb3d19
Instruction Fuzzy Hash: 6EF0C2316007209FD7245B16E884E77BBFAFF94711B00882DF68243A50CA75E812C7A0

Function 640D3EC0 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.00000000640D3000.00000020.00000001.01000000.00000015.sdmp, Offset: 640D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_640d3000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a881a544e69525621e8e6714dab103f375e621a6147a1b3fd6529ba45096963
Instruction ID: 596b52fea364f089acbb95778fcb4850f50456cb4ee61087063553488bdef370
Opcode Fuzzy Hash: 6a881a544e69525621e8e6714dab103f375e621a6147a1b3fd6529ba45096963
Instruction Fuzzy Hash: 50F062726007049FD335CF45E801B56B7F8EF81B15F10842EE29A9B9D0D7F4A845CB84

Function 640D3EB6 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.00000000640D3000.00000020.00000001.01000000.00000015.sdmp, Offset: 640D3000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_640d3000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b4563cbb4677bc0e8c6cc9793c49ec8ecdaeee6caebe29d592ff9defa762a7
Instruction ID: 3b06ed85040e5ba6c04e8cb9bf1ea2209dcd7810eb0cd71cc8fae09ce7564f84
Opcode Fuzzy Hash: 49b4563cbb4677bc0e8c6cc9793c49ec8ecdaeee6caebe29d592ff9defa762a7
Instruction Fuzzy Hash: DCF0B4B26007059FD3348F45E802B96B7F8EF81B15F10481FE2998B9D1D7B4A885CB85

Function 63597EB0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063597000.00000020.00000001.01000000.00000015.sdmp, Offset: 63597000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63597000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4e9dd2fb86fec542d5df0471123bbf4025209b795a53e66fc79ce552c408cb
Instruction ID: 075e85051a9b3665b944dec58c1a6ac709ba0b65dca901298a574dc55439eb5c
Opcode Fuzzy Hash: 4f4e9dd2fb86fec542d5df0471123bbf4025209b795a53e66fc79ce552c408cb
Instruction Fuzzy Hash: D1019A786483809FD610CF18C494A1ABBE2FBC9B14F14490AE89997390D771E841CB82

Function 0688C68A Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2765b21ea16f3e8fef50ce4353fad2fbd121a81f7a3f00ff7d8c2c6eee209b68
Instruction ID: e410a65b3b76ae53e902ad2e017ef7227acca042ed575562213faf38c897a5bf
Opcode Fuzzy Hash: 2765b21ea16f3e8fef50ce4353fad2fbd121a81f7a3f00ff7d8c2c6eee209b68
Instruction Fuzzy Hash: 31F04F30201A019FC711EB28E9549AABBF1FF81705B0586B9E0458B67BDB35ED49CBD1

Function 0688E6D0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 188f642c8dc497e082a87dbf221fec7ede1f59c9432145a7dc5abbed70958567
Instruction ID: dbf1bf6b6c02c4f618491e80cec9c294e52f9fa06acf8efe18e22c108940c899
Opcode Fuzzy Hash: 188f642c8dc497e082a87dbf221fec7ede1f59c9432145a7dc5abbed70958567
Instruction Fuzzy Hash: F1F0E5213442941FD651A63C19246BFBF9E8BC1A60B1909B2E745C7355DDA1CC06C3F4

Function 0688A4D0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d6bd54b79846bd874dc329bc7bd3ee132e75cadce746476715c352dd23157d
Instruction ID: 356cf3bfee707e6d1e433c405407be39ffb17fc06c400401e1a7825164c361fb
Opcode Fuzzy Hash: e2d6bd54b79846bd874dc329bc7bd3ee132e75cadce746476715c352dd23157d
Instruction Fuzzy Hash: E6E09B333401546F4714998FE8C4C6EB79DFBD91713504037F608C7251CA25DC45C760

Function 059FC000 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111a81e52386344a91eecf9451bef5fedc74bac118a9e4248a899cafc16f3048
Instruction ID: 7de1f5f9c90dbe65db52d6fc0a55f435476846e02b3ae3109b46d357a8800dbf
Opcode Fuzzy Hash: 111a81e52386344a91eecf9451bef5fedc74bac118a9e4248a899cafc16f3048
Instruction Fuzzy Hash: 42F01430D0031ADFCB44DFA9C9405AABBB6FF48300F208869C56AA7250D335AA42CF80

Function 0688B6E7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c4595b7f912d17c2ab4e4740a13a26f9d144650acc38d85b9aef356b737fdc
Instruction ID: 0ff1d318af94fc74fcccae1ea8616f560a3e50965a8cc7ae88a52f2a5dcc3ca6
Opcode Fuzzy Hash: 29c4595b7f912d17c2ab4e4740a13a26f9d144650acc38d85b9aef356b737fdc
Instruction Fuzzy Hash: F6E092353452405FC3159B69DC15D5A7BF9EFCAA11B0500ABF645C73B2DE219C04C7A0

Function 059FFC58 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ecbc5ae8c750fdf19aeca069077e991dfff178051185fc262c51c7fbd0ed2e
Instruction ID: 2ec904e9c5ecb0c760986f1244e08aba04d2d9f9c8ccd176a522f011fd3e34ea
Opcode Fuzzy Hash: 28ecbc5ae8c750fdf19aeca069077e991dfff178051185fc262c51c7fbd0ed2e
Instruction Fuzzy Hash: E9E022BBF0012893DF208198DC513EEB32AF7D8361F048936D602A3344EBB0A9054780

Function 63C6A540 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063C6A000.00000020.00000001.01000000.00000015.sdmp, Offset: 63C6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63c6a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: febd73d7f479ac0a95972855e0cbe470e2b8d1c6b6520c90b57c5aefdb7b9776
Instruction ID: e1b340f8f61e86017603b14e741edaf181027e33a1d14a5968497510a34660a7
Opcode Fuzzy Hash: febd73d7f479ac0a95972855e0cbe470e2b8d1c6b6520c90b57c5aefdb7b9776
Instruction Fuzzy Hash: FFE01271E00218BBCF04EF69C85599EBBBDEF8A268B504069EC0A97241DB317E108BD5

Function 059FE369 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71a88bb9ff873cbec1a293b7b99cb205002294a5ecbaf681691e244a462e00f7
Instruction ID: 3a6207171ff70e8f403a9d48e968c5d9e8933bae5f62588baa0629ffbae4fae9
Opcode Fuzzy Hash: 71a88bb9ff873cbec1a293b7b99cb205002294a5ecbaf681691e244a462e00f7
Instruction Fuzzy Hash: 8DD05B213192E05FC71721E92CA48BB1FAACAC251035555AFF044DB741DD648D0253B1

Function 61FACB50 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061FAC000.00000020.00000001.01000000.00000015.sdmp, Offset: 61FAC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61fac000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42a6e084b15a92aaf0b2c57dac4520b63358818f64976ceec02bc4fc31c3c25
Instruction ID: 6ee6e484099728ce3057718277a1bbf0c933f9e8fd0caa337f947ec6c0c81a76
Opcode Fuzzy Hash: d42a6e084b15a92aaf0b2c57dac4520b63358818f64976ceec02bc4fc31c3c25
Instruction Fuzzy Hash: DFE04FB1E0022967DA00ABB5A81666E7BE89F45118F418079D80A9B240FA316D18C7D6

Function 63CC7B90 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063CC7000.00000020.00000001.01000000.00000015.sdmp, Offset: 63CC7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63cc7000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a9e6fa960df714d8f46f22775b1e700153ca776dc9d824abb86a561630d1c2
Instruction ID: a2c8c073d20354db4482328301b509f20310fead1533fe07379a8c8afe76874e
Opcode Fuzzy Hash: e5a9e6fa960df714d8f46f22775b1e700153ca776dc9d824abb86a561630d1c2
Instruction Fuzzy Hash: 74F030B4D0031D9FCB08DF58C4519AEBBB5FF09214B42459ED8165B351EB30E944CBD1

Function 61CBFA50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061CBF000.00000020.00000001.01000000.00000015.sdmp, Offset: 61CBF000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61cbf000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7291612d7abace6d1f895ec0ee72b0e1ac043de5626cc76e05c78110646b547
Instruction ID: 384e13f116c55ff15eb3e4089c2ec3df21349aa0774b73a9ee41d75eb7b1151a
Opcode Fuzzy Hash: b7291612d7abace6d1f895ec0ee72b0e1ac043de5626cc76e05c78110646b547
Instruction Fuzzy Hash: D4D0A7E270417833D420564A3C45E3F75ACC7E3A79B00043EF609E7741D5A55C1543E9

Function 0688B6F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4724283896.0000000006880000.00000040.00000800.00020000.00000000.sdmp, Offset: 06880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6880000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 763fb6dc70fc471655c4ede2e565555a5be786e2c1b0d3562bfdb791b2353ae9
Instruction ID: 41384c73e94f6b226bb987b2a9ae5f5f7f7ba4ce714f9d47169570b53d1faa23
Opcode Fuzzy Hash: 763fb6dc70fc471655c4ede2e565555a5be786e2c1b0d3562bfdb791b2353ae9
Instruction Fuzzy Hash: C4D017357502105BC748666EA818D2A3BE9DBCAA21B01006AF609CB3A1DE61DC0186A4

Function 63C4AB40 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063C4A000.00000020.00000001.01000000.00000015.sdmp, Offset: 63C4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63c4a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15a5608176b36aae10df8ca44f2ff5549e7b325626994e6f64f8e6c877d2a802
Instruction ID: d80222248ae038efc09da12a331a14937ebfc604b8d50f504ca40d4c8a3d7e35
Opcode Fuzzy Hash: 15a5608176b36aae10df8ca44f2ff5549e7b325626994e6f64f8e6c877d2a802
Instruction Fuzzy Hash: E2D05E3A3002186F86009A0AD884C6ABBADEBDE2703144426EA0687301C632BC029AF0

Function 059FE378 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1bfe031a4c6df2f722743317201dc78163715eaa78f0a7003bd7e349da5db5
Instruction ID: eb85a8033fc814e1928c37602484aee0f2029791f917e59c3b6e5bdcf415242e
Opcode Fuzzy Hash: 0b1bfe031a4c6df2f722743317201dc78163715eaa78f0a7003bd7e349da5db5
Instruction Fuzzy Hash: 72C01222320268270A1931EE285187F26CECAC6961354446AE619DB344DCB09C0223E1

Function 6409436E Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000064094000.00000020.00000001.01000000.00000015.sdmp, Offset: 64094000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_64094000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a43d21c1e975b87af034721b8f3017f269078662c0b7dd56cd21983961796e
Instruction ID: a7d075f3bcb830d0cefeeecc6a52f1c5e540f1998ad1a765620439288fa6b08d
Opcode Fuzzy Hash: e5a43d21c1e975b87af034721b8f3017f269078662c0b7dd56cd21983961796e
Instruction Fuzzy Hash: 15D05E3514862AF9DF000979FC0076977E80B01378710A221A978481F0DB20C6E2A189

Function 61D8AF00 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000061D8A000.00000020.00000001.01000000.00000015.sdmp, Offset: 61D8A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_61d8a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77983f42352063c338c9f306ebc50001d031783cac1aa1506ccb5566080f16f
Instruction ID: 8b5174c32604fd486615462c6d1d366bf9069d083afe6783b5ccb8085a2973dd
Opcode Fuzzy Hash: b77983f42352063c338c9f306ebc50001d031783cac1aa1506ccb5566080f16f
Instruction Fuzzy Hash: 31C0123250020C6BDF06DF949C01CA9375AEB8C694F448010F91C05151D67295709B52

Function 63C6A520 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4791869623.0000000063C6A000.00000020.00000001.01000000.00000015.sdmp, Offset: 63C6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_63c6a000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2df68f18194136095033dcfe47af83164b6859a4209793eae8b6a93d1d84c02
Instruction ID: 55678e501adba674d7b6c33e2718af0281e9146e1e60d72793ac96a61f73f952
Opcode Fuzzy Hash: c2df68f18194136095033dcfe47af83164b6859a4209793eae8b6a93d1d84c02
Instruction Fuzzy Hash: D2C02BB141030C5FCF04EB4CFC46C56375CCE1050C7400000F80C8B203F921F52441B5

Function 059FEDD3 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.4700194767.00000000059F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 059F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_59f0000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e9c83d91c48219c4261666125667a17f215fa884a762cbe31062e54221c8b8
Instruction ID: 4afe2bd3080592a22dd18913f64289c2fccf2e254ebbd35c9847bc728f349751
Opcode Fuzzy Hash: 58e9c83d91c48219c4261666125667a17f215fa884a762cbe31062e54221c8b8
Instruction Fuzzy Hash: 8DC08C1290F3C14FCB668F788CA30187FF08A2674031C4CDB81C083693C820800E8346

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Threatname: Poverty Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat

C:\Users\user\AppData\Local\Temp\1B6E.exe

C:\Users\user\AppData\Local\Temp\DBD3.exe

C:\Users\user\AppData\Local\Temp\FD47.exe

C:\Users\user\AppData\Local\Temp\nsiA896.tmp\liteFirewall.dll

C:\Users\user\AppData\Local\Temp\nskFDD3.tmp

Windows Analysis Report
37e6e5d8b399fefb9ae774516ff6367e800c69a272e18a654bb84ccff2d7c67a_dump.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre