Edit tour

Windows Analysis Report
5GOuTtZoQn.exe

Overview

General Information

Sample name:	5GOuTtZoQn.exe renamed because original name is a hash value
Original sample name:	7fc4847438a3867ab9380525626d0cece5f31bd4d148864e4168616c182f7b6e.exe
Analysis ID:	1466817
MD5:	5f93b2e5faf3721c176353fd8ab82f9d
SHA1:	85b6c685a5a88e8e25385a73330defa2a3c9f373
SHA256:	7fc4847438a3867ab9380525626d0cece5f31bd4d148864e4168616c182f7b6e
Tags:	exeSmokeLoader
Infos:

Detection

LummaC, Poverty Stealer, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected LummaC Stealer

Yara detected Poverty Stealer

Yara detected SmokeLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Too many similar processes found

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

5GOuTtZoQn.exe (PID: 6668 cmdline: "C:\Users\user\Desktop\5GOuTtZoQn.exe" MD5: 5F93B2E5FAF3721C176353FD8AB82F9D)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

MpCmdRun.exe (PID: 352 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 2284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

E636.exe (PID: 4476 cmdline: C:\Users\user\AppData\Local\Temp\E636.exe MD5: BD2EAC64CBDED877608468D86786594A)

AD6.exe (PID: 352 cmdline: C:\Users\user\AppData\Local\Temp\AD6.exe MD5: 60172CA946DE57C3529E9F05CC502870)

setup.exe (PID: 504 cmdline: "C:\Users\user\AppData\Local\Temp\setup.exe" MD5: FF2293FBFF53F4BD2BFF91780FABFD60)

GamePall.exe (PID: 4484 cmdline: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6348 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3308 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6420 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3528 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6492 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3664 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6540 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077579277 --mojo-platform-channel-handle=3760 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6712 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077667358 --mojo-platform-channel-handle=4152 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1 MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6756 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4824 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2848 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 516 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6956 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6024 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5248 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1968 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6596 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1716 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5848 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1184 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4112 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 332 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 1236 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 5180 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 6932 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 7144 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 2108 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

GamePall.exe (PID: 4124 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

2DF0.exe (PID: 7024 cmdline: C:\Users\user\AppData\Local\Temp\2DF0.exe MD5: DA4B6F39FC024D2383D4BFE7F67F1EE1)

GamePall.exe (PID: 6548 cmdline: "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" MD5: 7A3502C1119795D35569535DE243B6FE)

wdugfia (PID: 6164 cmdline: C:\Users\user\AppData\Roaming\wdugfia MD5: 5F93B2E5FAF3721C176353FD8AB82F9D)

wdugfia (PID: 3232 cmdline: C:\Users\user\AppData\Roaming\wdugfia MD5: 5F93B2E5FAF3721C176353FD8AB82F9D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: LummaC

{"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "foodypannyjsud.shop"], "Build id": "bOKHNM--"}

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://movlat.com/tmp/", "http://llcbc.org/tmp/", "http://lindex24.ru/tmp/", "http://qeqei.xyz/tmp/"]}

Threatname: Poverty Stealer

{"C2 url": "146.70.169.164:2227"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2153839501.0000000003F90000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x604:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000003.2234378949.000000000175F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2236092761.000000000175F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000003.2234378949.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000006.00000003.2264120478.0000000001701000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2212422021.000000000175F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2235294827.0000000001700000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000006.00000003.2264560521.0000000001706000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x204:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000006.00000003.2232951408.000000000175F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2153686108.0000000002471000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x3624:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000003.2236092761.0000000001700000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1854648292.00000000025B1000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x39c4:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000003.2235294827.000000000175F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2247835335.0000000001700000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Process Memory Space: E636.exe PID: 4476	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: E636.exe PID: 4476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: E636.exe PID: 4476	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 2DF0.exe PID: 7024	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 27 entries

Unpacked PEs

Source	Rule	Description	Author
9.2.2DF0.exe.1276b20.1.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.2DF0.exe.12cc9c0.2.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.2DF0.exe.3950000.3.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.2DF0.exe.12cc9c0.2.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.2DF0.exe.3950000.3.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
9.2.2DF0.exe.1276b20.1.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\setup.exe, ProcessId: 504, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GamePall

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\wdugfia, CommandLine: C:\Users\user\AppData\Roaming\wdugfia, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\wdugfia, NewProcessName: C:\Users\user\AppData\Roaming\wdugfia, OriginalFileName: C:\Users\user\AppData\Roaming\wdugfia, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\wdugfia, ProcessId: 6164, ProcessName: wdugfia

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\E636.exe	Avira: detection malicious, Label: HEUR/AGEN.1313486
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Avira: detection malicious, Label: HEUR/AGEN.1359405
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Avira: detection malicious, Label: HEUR/AGEN.1352426
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	Avira: detection malicious, Label: HEUR/AGEN.1359405

Found malware configuration

Source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://movlat.com/tmp/", "http://llcbc.org/tmp/", "http://lindex24.ru/tmp/", "http://qeqei.xyz/tmp/"]}
Source: 9.2.2DF0.exe.12cc9c0.2.unpack	Malware Configuration Extractor: Poverty Stealer {"C2 url": "146.70.169.164:2227"}
Source: 6.2.E636.exe.7a0000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["pedestriankodwu.xyz", "towerxxuytwi.xyz", "ellaboratepwsz.xyz", "penetratedpoopp.xyz", "swellfrrgwwos.xyz", "contintnetksows.shop", "foodypannyjsud.shop", "potterryisiw.shop", "foodypannyjsud.shop"], "Build id": "bOKHNM--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\E636.exe	ReversingLabs: Detection: 67%
Source: C:\Users\user\AppData\Roaming\wdugfia	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: 5GOuTtZoQn.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 5GOuTtZoQn.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: pedestriankodwu.xyz
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: towerxxuytwi.xyz
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: ellaboratepwsz.xyz
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: penetratedpoopp.xyz
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: swellfrrgwwos.xyz
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: contintnetksows.shop
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: foodypannyjsud.shop
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: potterryisiw.shop
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: foodypannyjsud.shop
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: - Screen Resoluton:
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: Workgroup: -
Source: 6.2.E636.exe.7a0000.0.unpack	String decryptor: bOKHNM--

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_03951C94 CryptUnprotectData,CryptProtectData,

9_2_03951C94

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Unpacked PE file: 9.2.2DF0.exe.3950000.3.unpack

Source: 5GOuTtZoQn.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: ntkrnlmp.pdbx, source: 2DF0.exe, 00000009.00000002.3005724520.000000000A9ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256f source: Newtonsoft.Json.dll.11.dr
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdb source: widevinecdmadapter.dll.11.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: 2DF0.exe, 00000009.00000002.3005724520.000000000A9EF000.00000004.00000020.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.3005724520.000000000A9ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: Newtonsoft.Json.dll.11.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: 2DF0.exe, 00000009.00000002.3005724520.000000000A9EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000C.00000000.3371439207.0000000000862000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 0000000E.00000002.3474550859.00000000052A2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 0000000E.00000002.3474550859.00000000052A2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdbGCTL source: widevinecdmadapter.dll.11.dr
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exemePalll source: setup.exe, 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb source: 2DF0.exe, 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe, 00000009.00000000.2323778514.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe.1.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 2DF0.exe, 00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3535618874.0000000000599000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3535618874.0000000000599000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831* source: 2DF0.exe, 00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb. source: 2DF0.exe, 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe, 00000009.00000000.2323778514.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe.1.dr

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1248

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B7256E FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00B7256E
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03951000 FindFirstFileW,FindNextFileW,EnterCriticalSection,LeaveCriticalSection,	9_2_03951000
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03954E27 FindFirstFileW,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,	9_2_03954E27
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03951D3C FindFirstFileW,FindNextFileW,	9_2_03951D3C
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_039540BA FindFirstFileW,FindNextFileW,	9_2_039540BA
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03953EFC FindFirstFileW,FindNextFileW,	9_2_03953EFC
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	11_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004066FF FindFirstFileA,FindClose,	11_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004027AA FindFirstFileA,	11_2_004027AA
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6051EA80 FindFirstFileExW,	14_2_6051EA80
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604EF346 FindFirstFileExW,	14_2_604EF346
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604EF3F7 FindFirstFileExW,RevokeDragDrop,FindNextFileW,FindClose,FindClose,	14_2_604EF3F7
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6051F490 FindFirstFileExW,	14_2_6051F490

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

14_2_604546F0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 141.8.194.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.147.2.86 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.97.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.101.193.110 80	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: pedestriankodwu.xyz
Source: Malware configuration extractor	URLs: towerxxuytwi.xyz
Source: Malware configuration extractor	URLs: ellaboratepwsz.xyz
Source: Malware configuration extractor	URLs: penetratedpoopp.xyz
Source: Malware configuration extractor	URLs: swellfrrgwwos.xyz
Source: Malware configuration extractor	URLs: contintnetksows.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: potterryisiw.shop
Source: Malware configuration extractor	URLs: foodypannyjsud.shop
Source: Malware configuration extractor	URLs: http://movlat.com/tmp/
Source: Malware configuration extractor	URLs: http://llcbc.org/tmp/
Source: Malware configuration extractor	URLs: http://lindex24.ru/tmp/
Source: Malware configuration extractor	URLs: http://qeqei.xyz/tmp/
Source: Malware configuration extractor	URLs: 146.70.169.164:2227

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_00B05B80 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,InternetOpenA,FreeLibrary,_strlen,InternetOpenUrlA,FreeLibrary,task,InternetReadFile,FreeLibrary,task,

9_2_00B05B80

Source: GamePall.exe, 0000000E.00000002.3470666729.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/activity
Source: GamePall.exe, 0000000E.00000002.3470666729.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.install-stat.debug.world/clients/installs
Source: GamePall.exe, 00000012.00000002.3683666966.0000000002261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bageyou.xyz
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: log4net.xml.11.dr	String found in binary or memory: http://logging.apache.org/log4j
Source: GamePall.exe	String found in binary or memory: http://logging.apache.org/log4ne
Source: GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp, log4net.xml.11.dr	String found in binary or memory: http://logging.apache.org/log4net/release/faq.html#trouble-EventLog
Source: log4net.xml.11.dr	String found in binary or memory: http://logging.apache.org/log4net/schemas/log4net-events-1.2>
Source: setup.exe, setup.exe, 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.3083333890.000000000040A000.00000008.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000003.3371912395.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: AD6.exe, 00000008.00000000.2263677389.000000000040A000.00000008.00000001.01000000.00000008.sdmp, setup.exe, 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.3083333890.000000000040A000.00000008.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000003.3371912395.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.000000000982D000.00000004.00000001.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: explorer.exe, 00000001.00000000.1845594851.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1845107188.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1846930986.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: GamePall.exe, GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.apache.org/).
Source: GamePall.exe, GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: GamePall.exe	String found in binary or memory: http://www.apache.org/licenses/LICEN
Source: GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000001.00000000.1844365188.00000000079B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: log4net.xml.11.dr	String found in binary or memory: http://www.connectionstrings.com/
Source: log4net.xml.11.dr	String found in binary or memory: http://www.faqs.org/rfcs/rfc3164.html.
Source: log4net.xml.11.dr	String found in binary or memory: http://www.iana.org/assignments/multicast-addresses
Source: GamePall.exe, 0000000E.00000002.3475253670.0000000005F57000.00000002.00000001.00040000.0000001B.sdmp	String found in binary or memory: http://www.unicode.org/copyright.html
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: AD6.exe, 00000008.00000003.2266842133.0000000003070000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xiexie.wf/22_551/huge.dat
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 00000001.00000000.1848132573.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000001.00000000.1846263087.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000001.00000000.1846263087.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000001.00000000.1843592476.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1843056048.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000001.00000000.1846263087.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000001.00000000.1846263087.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/N
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2987292224.0000000001200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/fcsdcvscvc/sadcasdv/raw/62af221cbc4d137cf4e95f7d66f3ced90597b434/kupee
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/fcsdcvscvc/sadcasdv/raw/62af221cbc4d137cf4e95f7d66f3ced90597b434/kupeeC
Source: E636.exe, 00000006.00000003.2237638501.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: resources.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore/category/extensions
Source: bg.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bg&category=theme81https://myactivity.google.com/myactivity/?u
Source: bg.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=bgCtrl$1
Source: GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u
Source: GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enCtrl$1
Source: hi.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hi&category=theme81https://myactivity.google.com/myactivity/?u
Source: hi.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=hiCtrl$1
Source: it.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=it&category=theme81https://myactivity.google.com/myactivity/?u
Source: it.pak.11.dr	String found in binary or memory: https://chrome.google.com/webstore?hl=itCtrl$1
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-CNCtrl$1
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=zh-TWCtrl$1
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherEnabled
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlGreylist
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUrlList
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chromeenterprise.google/policies/#BrowserSwitcherUseIeSitelist
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22
Source: E636.exe, 00000006.00000003.2237638501.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: E636.exe, 00000006.00000003.2237638501.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d136azpfpnge1l.cloudfront.net/;
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d301sr5gafysq2.cloudfront.net/
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2234378949.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264120478.0000000001701000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2305761007.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2235294827.0000000001700000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2279914840.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309380905.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2232951408.000000000175F000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2236092761.0000000001700000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285339247.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/
Source: E636.exe, 00000006.00000003.2234378949.000000000175F000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2236092761.000000000175F000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2232951408.000000000175F000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/))
Source: E636.exe, 00000006.00000003.2306543149.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2307179911.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309225728.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/0Hx
Source: E636.exe, 00000006.00000003.2279914840.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285339247.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/F9
Source: E636.exe, 00000006.00000003.2232951408.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/P
Source: E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/api
Source: E636.exe, 00000006.00000003.2306543149.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309359717.0000000001767000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2306987140.0000000001764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apiAs
Source: E636.exe, 00000006.00000003.2306543149.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285575589.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309359717.0000000001767000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2306987140.0000000001764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apiP
Source: E636.exe, 00000006.00000003.2280247691.0000000001766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apids
Source: E636.exe, 00000006.00000003.2285575589.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2280247691.0000000001766000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/apins
Source: E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/bm
Source: E636.exe, 00000006.00000003.2279914840.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285339247.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/bu
Source: E636.exe, 00000006.00000003.2305761007.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2279914840.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309380905.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285339247.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/dtcLx
Source: E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/jh5S
Source: E636.exe, 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/k
Source: E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/la
Source: E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/la.S
Source: E636.exe, 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/ldOL
Source: E636.exe, 00000006.00000002.2309380905.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2232951408.000000000175F000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/pi
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2223257274.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/pim
Source: E636.exe, 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/r0L
Source: E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264750383.000000000176F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/s
Source: E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264750383.000000000176F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/s.S
Source: E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264750383.000000000176F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/t
Source: E636.exe, 00000006.00000003.2279914840.0000000001777000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop/xLs
Source: E636.exe, 00000006.00000003.2212422021.00000000016E3000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2223257274.00000000016E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://foodypannyjsud.shop:443/api
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: E636.exe, 00000006.00000003.2237638501.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://myactivity.google.com/
Source: explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: bg.pak.11.dr	String found in binary or memory: https://passwords.google.com
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://passwords.google.comGoogle
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://policies.google.com/
Source: explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://support.google.com/chrome/a/answer/9122284
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://support.google.com/chrome/answer/6098869
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	String found in binary or memory: https://support.google.com/chromebook?p=app_intent
Source: E636.exe, 00000006.00000003.2212749407.0000000003E4E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: E636.exe, 00000006.00000003.2212749407.0000000003E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: E636.exe, 00000006.00000003.2212749407.0000000003E4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: GamePall.exe, GamePall.exe, 0000000E.00000002.3473718724.0000000004E76000.00000002.00000001.01000000.00000012.sdmp, GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1
Source: 2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-rep
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000001.00000000.1848132573.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: E636.exe, 00000006.00000003.2237638501.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: resources.pak.11.dr	String found in binary or memory: https://www.google.com/
Source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, hi.pak.11.dr, bg.pak.11.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.html
Source: it.pak.11.dr	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlG&uidaGestito
Source: GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp	String found in binary or memory: https://www.google.com/chrome/privacy/eula_text.htmlH&elpManaged
Source: E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.newtonsoft.com/json
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: Newtonsoft.Json.dll.11.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 11_2_004055E7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

11_2_004055E7

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_03954BA2 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetDC,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateDIBSection,SelectObject,BitBlt,DeleteObject,DeleteDC,ReleaseDC,

9_2_03954BA2

Source: GamePall.exe

Process created: 52

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000005.00000002.2153839501.0000000003F90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000005.00000002.2153686108.0000000002471000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1854648292.00000000025B1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Windows\explorer.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004030C5 RtlCreateUserThread,NtTerminateProcess,	0_2_004030C5
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004015E9 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015E9
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00401603 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401603
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00401609 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401609
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00401619 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401619
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00403222 RtlCreateUserThread,NtTerminateProcess,	0_2_00403222
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00401632 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_00401632
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004033D2 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	0_2_004033D2
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004033D9 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	0_2_004033D9
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004033DF NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	0_2_004033DF
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004015F4 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_004015F4
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004033F5 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	0_2_004033F5
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004017F7 NtMapViewOfSection,	0_2_004017F7
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00403385 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	0_2_00403385
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_0040338F NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	0_2_0040338F
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00403399 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	0_2_00403399
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_004033A5 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,wcsstr,	0_2_004033A5
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004030C5 RtlCreateUserThread,NtTerminateProcess,	5_2_004030C5
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004015E9 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004015E9
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00401603 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401603
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00401609 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401609
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00401619 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401619
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00403222 RtlCreateUserThread,NtTerminateProcess,	5_2_00403222
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00401632 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_00401632
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004033D2 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	5_2_004033D2
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004033D9 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	5_2_004033D9
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004033DF NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	5_2_004033DF
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004015F4 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	5_2_004015F4
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004033F5 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	5_2_004033F5
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004017F7 NtMapViewOfSection,	5_2_004017F7
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00403385 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	5_2_00403385
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_0040338F NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	5_2_0040338F
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00403399 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,	5_2_00403399
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_004033A5 NtTerminateProcess,GetModuleHandleA,CreateFileW,GetForegroundWindow,wcsstr,	5_2_004033A5
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60474FA0 RtlInitUnicodeString,NtOpenKeyEx,	14_2_60474FA0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60475140 RtlInitUnicodeString,NtQueryValueKey,NtQueryValueKey,NtQueryValueKey,NtQueryValueKey,NtQueryValueKey,	14_2_60475140
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60475610 NtClose,	14_2_60475610
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604741C0 NtClose,NtClose,RtlInitUnicodeString,NtCreateKey,NtClose,NtClose,RtlInitUnicodeString,NtCreateKey,NtDeleteKey,	14_2_604741C0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60475120 NtClose,	14_2_60475120
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60475690 RtlInitUnicodeString,NtSetValueKey,	14_2_60475690
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60475700 RtlInitUnicodeString,NtSetValueKey,	14_2_60475700

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 11_2_004034CC EntryPoint,SetErrorMode,GetVersionExA,GetVersionExA,GetVersionExA,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

11_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B61490	9_2_00B61490
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B6D515	9_2_00B6D515
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B6BE09	9_2_00B6BE09
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_00406A88	11_2_00406A88
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604A0D00	14_2_604A0D00
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604A36F0	14_2_604A36F0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6047DC00	14_2_6047DC00
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604A3C00	14_2_604A3C00
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604940D0	14_2_604940D0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604520B0	14_2_604520B0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604B40B0	14_2_604B40B0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604741C0	14_2_604741C0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604B61B0	14_2_604B61B0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604F427A	14_2_604F427A
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6047C220	14_2_6047C220
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604562CD	14_2_604562CD
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6049A370	14_2_6049A370
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604563ED	14_2_604563ED
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604D4397	14_2_604D4397
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60520400	14_2_60520400
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604564C9	14_2_604564C9
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604B2490	14_2_604B2490
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6049A570	14_2_6049A570
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C65A0	14_2_604C65A0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60452640	14_2_60452640
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60498610	14_2_60498610
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6048C6C0	14_2_6048C6C0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60462700	14_2_60462700
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604587FD	14_2_604587FD
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60496790	14_2_60496790
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6048C7A0	14_2_6048C7A0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604A8840	14_2_604A8840
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60456855	14_2_60456855
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C8860	14_2_604C8860
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604AE830	14_2_604AE830
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604988A0	14_2_604988A0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6051C960	14_2_6051C960
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60480970	14_2_60480970
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60520930	14_2_60520930
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60456A5D	14_2_60456A5D
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60522A70	14_2_60522A70
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C2A90	14_2_604C2A90
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60498BC0	14_2_60498BC0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C6BA0	14_2_604C6BA0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604D6C40	14_2_604D6C40
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60454C00	14_2_60454C00
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60452C30	14_2_60452C30
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604AECB0	14_2_604AECB0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604CADE0	14_2_604CADE0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60520E60	14_2_60520E60
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604ACE70	14_2_604ACE70
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60482EE0	14_2_60482EE0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604D2E8A	14_2_604D2E8A
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60464F30	14_2_60464F30
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60452FD7	14_2_60452FD7
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6047AFB0	14_2_6047AFB0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_605210C0	14_2_605210C0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60523100	14_2_60523100
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C51D0	14_2_604C51D0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604AD2E0	14_2_604AD2E0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604BF2E0	14_2_604BF2E0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604CF2E0	14_2_604CF2E0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604CB2E0	14_2_604CB2E0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C32F0	14_2_604C32F0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604A52B0	14_2_604A52B0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60469310	14_2_60469310
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60491470	14_2_60491470
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60479410	14_2_60479410
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60515490	14_2_60515490
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C1490	14_2_604C1490
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60523510	14_2_60523510
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604D75C4	14_2_604D75C4
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60521640	14_2_60521640
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604516C0	14_2_604516C0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604F56A9	14_2_604F56A9
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60483750	14_2_60483750
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6051B730	14_2_6051B730
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604A9730	14_2_604A9730
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604557D0	14_2_604557D0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C77D0	14_2_604C77D0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604917F0	14_2_604917F0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604658E0	14_2_604658E0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6049D890	14_2_6049D890
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C5A40	14_2_604C5A40
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604BDA00	14_2_604BDA00
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60451A30	14_2_60451A30
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60463A80	14_2_60463A80
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60451B60	14_2_60451B60
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604D3B1B	14_2_604D3B1B
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604AFBC0	14_2_604AFBC0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C3B80	14_2_604C3B80
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604BFB90	14_2_604BFB90
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60467BA0	14_2_60467BA0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C5BA0	14_2_604C5BA0
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604C9C40	14_2_604C9C40
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60491C50	14_2_60491C50
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60455C00	14_2_60455C00
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60453C80	14_2_60453C80
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60451D10	14_2_60451D10
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6047FF00	14_2_6047FF00
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60465F80	14_2_60465F80
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_00B64E20	14_2_00B64E20

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: String function: 00B60310 appears 51 times
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: String function: 604FCE60 appears 513 times
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: String function: 604CDF70 appears 52 times
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: String function: 604FB830 appears 61 times
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: String function: 60516700 appears 39 times

Source: 5GOuTtZoQn.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000005.00000002.2153839501.0000000003F90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000005.00000002.2153686108.0000000002471000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1854648292.00000000025B1000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: Ionic.Zip.dll.11.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformBlock'
Source: Ionic.Zip.dll.11.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Ionic.Zip.dll.11.dr, WinZipAesCipherStream.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: GamePall.exe.11.dr, Program.cs

Base64 encoded string: 'pizR9uKkcZIkMW+F1cRjYV0LMt6eYXmLuiNCndESDPkTO3eY1Mjv7Hs2Qvo+t26G', 'ZTDMzZVpdA1FSa2RiY6ZCl2QGyLDtQ3OBRa/N40wO2xxcvcDsATtLRGwKtaEB36dqPJnDF8qXNs92JbMBlsOyg==', 'nYQvMVlU2Asj2rNkmi7xBNqGCkGzSnaP0raCPfB8A9hSwWFTIjPcsKgDrCVAEwSQ1lHf/WOhnKR59a5JjrkJVUOFvV43wO8MM1FKgjYuj7ZzvvuGve+okViUQx+oGN+llGnjS4Fm9o1MUn7p+qcPVIDZRcvMal1ARjQNk+bFvT5vC4J8slkhLZYtvBYmOybvSK90G7/f/U8GPBdM7WBmfFdHzzGxw6WFcHlkdySP8Nvmzff08RdOn8QOu8FlABEqqEjQ0W84v+/lU0lmhvzugpodd8fIp2kb2/twZPg9/Jsy5viOC65K8bs1ES63SA2d62f5cJYpFf1f0WBQbCBcSzfwiDlBCWVIW9vFXW1awyEMdm3q36+BViyETC5tnyHuoLRgf3bXoQAwqE0OIII5DROfW+LmqqHY82rVXHAqhVjdA2wZRWcSI1zxV7+qTfhmp9qbIQAWSuuXTzhbIvI3gjvtPCdz9uBv8rjyg1XZNxfdgYdtF+klyGgKdefnu5G2pgjfT3Kb/VbjgkFvLlqtWNr5K7iC080FVeHsZazMHUrrDtsmNdChtvnX8Zj77rIGVxi9RfvHhhIhBj+WSos+lJ2nuvQkUpqVEa1mrZSwPezG/uoh0qvs+BAHbNFNjv99WS6tgWIkvcQVCi2h3cfxTGQiZDetQZqB+N/mnvgC6WdrcRKGHBE4mp6bpgTY9+nt3lPiH6OZnlxC8rdHbuGtY6R/FgNFYkw49JWXYeZ1VV3KnjSrFMvDlkyMCAW1X9/1VoC+f73WVYMLwXafDKtGO2lfr9vwKms+8HoEgs7bj0aroIPdmLK/z/djAsFZO8Vp', 'T7BWwqrn4yISEECEAnARpwE8R+3lDHSc+RlcJT90an1SNsS27lGBQjOx4RmDHlrj7oJnnzx1IWXOkbTfLzBeCfU6UJhOIoQKhcWidAxAKIxvqZnoB6AujIU0F7dEj65vahyTdEvkIxzFaV2+akbl53KcDi5RPBOP16iXVi0WJdHV5AbSCI9WCEcSX/fUpmukBh4bjVF/T/P/B6TFVtNZintCOSO2Ha+2va2CJMOnJ020zYskwuvcH9d1rGD3Zf9RBC2obzrhRNK2LXTEIYnifs6L2UdqFhw5aANXILziQtzKvsTQKvc15hvHCCoeXJCyyK7/WgA/oRu7bdrTs2DwCQ==', 'ZY0WCEgzqiLEU8ZUVJwGTpbkuL9KoMwYVloBqJXjur8rfBZEXTysQNKRQ1H7/vn7o0wyHAux60SVy06r4v6So5WWxddei09LXvL6ZwK/tyY=', 's7iS2XfzyI+IBoARaZQlTINg1kEy7qT7EopaSHQzpqktZBtc7UiOYrPdv/6f4cNI', 'o2ZleBui4P9C2ZjnB98Vuesy1C+WucHiXjQJ8RANoX6TheGfnLYAWDsXRfSeNCDHWdkBP2RBrkWPBy/nuM2NFLMETMUsPFeG3JHWafvGKzaNEjYO3Up9m61SnaY5tINvLCYJ/TKITszJ9H1YSm2chnmQGLUzbz4pwvWvvKfH8m7z585W73/QZrtw3l/30vcZaVocgwemYusDJYsOTgeWc0okiDahD7qtJcBYZ0aOzxZZmHDMBYigkRVf8GTJ/xucA/i7EHBFpaWoLVZVcuGFMA==', 'T7BWwqrn4yISEECEAnARp+JyVgG3cZc2/9+3VbyOjc4PuRSCU7ZfXuXpIIH8uj2roUU+W7nSmXHqTuxLhe6DBfNVh8PFZrhNX/YhIexDxrk=', 'G4TxOgdwfNBdU+6bscw2hqt3kZYZMfoEuKZtmCxRLrF8xJCK1+L0ocd8eSQjty7d', 'PcG64iM3U1vDIVDm7HuwTSvKhuz45f/WPqYoWZvzLHcapbEfkynZkUjmDgg30eof', 'XGcq7Js3+2f2oGHGFzxJPiYsrodwK+bTw/0lKjiUd0tSWMHEjdVqzAclD1/nPksq3sGhVTN8oFeHMRE7wAt3mCLVCEXKF9JLnNeWw9vvCbs=', 'T7BWwqrn4yISEECEAnARp8UQ6kvfa8mDiwe39obQZ+Rxfj5bbo//kf+4mlTsZUEg0QM/4QBKb6sUDMsk9OTdYg==', 'T7BWwqrn4yISEECEAnARp/U1NCwfjpQ4K5UKuMbDqXSrjfU6Tf/pOCpHlHXtYnU5', 'Gg/rFkGmnFrfPAny9sQ3qerPGxlC7+cuu92x2tgXrCRkqABwTbbIR8+hJN0krbBD9OJX8s2JqeR+xICuD2u17N7KjlWCZwpg4+c7mG1xAahALfXXbu/EvJy+KsAzQlzR9bu8P4wbyuM6r6/7kdf+VQ==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLT3pudJg4gGhcEax3IHwBI0R5vZR7J9mjUQ8R9MdKz/Fw==', 'Zh3o1d4Zr0FJ548CrzCJDMeQhe52nu1Hz4hkTFOalLTcCwJrbTmNGWmZutw1Di2FSZ+3JxFtC00BiemuQuq2+A=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@240/115@0/8

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Code function: 14_2_605165D0 FormatMessageA,GetLastError,_strlen,

14_2_605165D0

Source: C:\Users\user\AppData\Local\Temp\setup.exe

11_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 11_2_00404897 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

11_2_00404897

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe

Code function: 0_2_025B49F2 CreateToolhelp32Snapshot,Module32First,

0_2_025B49F2

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Code function: 11_2_00402173 CoCreateInstance,MultiByteToWideChar,

11_2_00402173

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\wdugfia

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_rendLog.txt
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2284:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Mutant created: \Sessions\1\BaseNamedObjects\1e7f31ac-1494-47cc-9633-054c20e7432e
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Users_user_AppData_Roaming_GamePall_Logs_mainLog.txt

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\E636.tmp

Jump to behavior

Source: 5GOuTtZoQn.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: E636.exe, 00000006.00000003.2212835658.0000000003E24000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 5GOuTtZoQn.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\5GOuTtZoQn.exe "C:\Users\user\Desktop\5GOuTtZoQn.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wdugfia C:\Users\user\AppData\Roaming\wdugfia
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E636.exe C:\Users\user\AppData\Local\Temp\E636.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\AD6.exe C:\Users\user\AppData\Local\Temp\AD6.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2DF0.exe C:\Users\user\AppData\Local\Temp\2DF0.exe
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3308 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3528 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3664 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077579277 --mojo-platform-channel-handle=3760 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077667358 --mojo-platform-channel-handle=4152 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wdugfia C:\Users\user\AppData\Roaming\wdugfia
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E636.exe C:\Users\user\AppData\Local\Temp\E636.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\2DF0.exe C:\Users\user\AppData\Local\Temp\2DF0.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Process created: C:\Users\user\AppData\Local\Temp\setup.exe "C:\Users\user\AppData\Local\Temp\setup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3308 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3528 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3664 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077579277 --mojo-platform-channel-handle=3760 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077667358 --mojo-platform-channel-handle=4152 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: cdprt.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: audioses.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mdmregistration.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: omadmapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dmcmnutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iri.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscms.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dsreg.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: chrome_elf.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50CE75BC-766C-4136-BF5E-9197AA23569E}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\setup.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\GamePall

Jump to behavior

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: ntkrnlmp.pdbx, source: 2DF0.exe, 00000009.00000002.3005724520.000000000A9ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdbSHA256f source: Newtonsoft.Json.dll.11.dr
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdb source: widevinecdmadapter.dll.11.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: 2DF0.exe, 00000009.00000002.3005724520.000000000A9EF000.00000004.00000020.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.3005724520.000000000A9ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: /_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb source: Newtonsoft.Json.dll.11.dr
Source:	Binary string: libEGL.dll.pdb source: setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: 2DF0.exe, 00000009.00000002.3005724520.000000000A9EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e:\work\newContent\secondBranch\new\GamePall\obj\Release\GamePall.pdb source: GamePall.exe, 0000000C.00000000.3371439207.0000000000862000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdb source: GamePall.exe, GamePall.exe, 0000000E.00000002.3474550859.00000000052A2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdbLK source: GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: E:\work\newContent\secondBranch\cefglue-main\CefGlue\obj\Release\net40\Xilium.CefGlue.pdbSHA256 source: GamePall.exe, 0000000E.00000002.3474550859.00000000052A2000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\chrome_elf.dll.pdb source: GamePall.exe, 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: Y:\work\CEF3_git\chromium\src\out\Release_GN_x86\WidevineCdm\_platform_specific\win_x86\widevinecdmadapter.dll.pdbGCTL source: widevinecdmadapter.dll.11.dr
Source:	Binary string: *?\|<>/":%s%s.dllC:\Users\user\AppData\Roaming\GamePall\GamePall.exeewall.dllll.pdbC:\Users\user\AppData\Roaming\GamePall\Uninstall.exemePalll source: setup.exe, 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmp
Source:	Binary string: c:\log4net\tags\2.0.8RC1\bin\net\4.0\release\log4net.pdb source: GamePall.exe, GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb source: 2DF0.exe, 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe, 00000009.00000000.2323778514.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe.1.dr
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: 2DF0.exe, 00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Xilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3535618874.0000000000599000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \swiftshaderXilium.CefGlue.pdb source: setup.exe, 0000000B.00000002.3535618874.0000000000599000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831* source: 2DF0.exe, 00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \Desktop\projects\Release\BigProject.pdb. source: 2DF0.exe, 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe, 00000009.00000000.2323778514.0000000000B79000.00000002.00000001.01000000.0000000C.sdmp, 2DF0.exe.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Unpacked PE file: 0.2.5GOuTtZoQn.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\wdugfia	Unpacked PE file: 5.2.wdugfia.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Unpacked PE file: 9.2.2DF0.exe.3950000.3.unpack

Source: Newtonsoft.Json.dll.11.dr

Static PE information: 0xF68F744F [Mon Jan 31 06:35:59 2101 UTC]

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

9_2_00B05B80

Source: initial sample

Static PE information: section where entry point is pointing to: .vmpLp

Source: E636.exe.1.dr	Static PE information: section name: .vmpLp
Source: E636.exe.1.dr	Static PE information: section name: .vmpLp
Source: E636.exe.1.dr	Static PE information: section name: .vmpLp
Source: libEGL.dll.11.dr	Static PE information: section name: .00cfg
Source: libEGL.dll.11.dr	Static PE information: section name: .voltbl
Source: libGLESv2.dll.11.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.11.dr	Static PE information: section name: .voltbl
Source: chrome_elf.dll.11.dr	Static PE information: section name: .00cfg
Source: chrome_elf.dll.11.dr	Static PE information: section name: .crthunk
Source: chrome_elf.dll.11.dr	Static PE information: section name: CPADinfo
Source: chrome_elf.dll.11.dr	Static PE information: section name: malloc_h
Source: libEGL.dll0.11.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll0.11.dr	Static PE information: section name: .00cfg
Source: libcef.dll.11.dr	Static PE information: section name: .00cfg
Source: libcef.dll.11.dr	Static PE information: section name: .rodata
Source: libcef.dll.11.dr	Static PE information: section name: CPADinfo
Source: libcef.dll.11.dr	Static PE information: section name: malloc_h

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_00403314 push eax; ret	0_2_004033EF
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_025B7379 push eax; ret	0_2_025B737A
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_00403314 push eax; ret	5_2_004033EF
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_02476FD9 push eax; ret	5_2_02476FDA
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B6004B push ecx; ret	9_2_00B6005E
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B689AD push cs; ret	9_2_00B689AE
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604CE38B push ecx; ret	14_2_604CE39E
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60457C10 push 89084589h; iretd	14_2_60457C15

Source: Ionic.Zip.dll.11.dr

Static PE information: section name: .text entropy: 6.821349263259562

Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\2DF0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\wdugfia	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E636.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	File created: C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\blowfish.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Local\Temp\nsjB8F5.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	File created: C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	File created: C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\AD6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	File created: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	File created: C:\Users\user\AppData\Local\Temp\setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\wdugfia

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GamePall			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\5gouttzoqn.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\wdugfia:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_9-145455

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\E636.exe

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Roaming\wdugfia	API/Special instruction interceptor: Address: 7FFE2220E814
Source: C:\Users\user\AppData\Roaming\wdugfia	API/Special instruction interceptor: Address: 7FFE2220D584
Source: C:\Users\user\AppData\Local\Temp\E636.exe	API/Special instruction interceptor: Address: CF8181
Source: C:\Users\user\AppData\Local\Temp\E636.exe	API/Special instruction interceptor: Address: 1007E15
Source: C:\Users\user\AppData\Local\Temp\E636.exe	API/Special instruction interceptor: Address: C44080
Source: C:\Users\user\AppData\Local\Temp\E636.exe	API/Special instruction interceptor: Address: B276F5
Source: C:\Users\user\AppData\Local\Temp\E636.exe	API/Special instruction interceptor: Address: B1AA71
Source: C:\Users\user\AppData\Local\Temp\E636.exe	API/Special instruction interceptor: Address: C891D7
Source: C:\Users\user\AppData\Local\Temp\E636.exe	API/Special instruction interceptor: Address: CC3463

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 5GOuTtZoQn.exe	Binary or memory string: ASWHOOK
Source: wdugfia, 00000005.00000002.2153599424.000000000245E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK{A4

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 27B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 47B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: AB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2890000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: D20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: F90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2940000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2FF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 830000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2260000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 11D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2AB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1050000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1100000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 11D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 45F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 14E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 30E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4A60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2970000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 29B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 8E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1140000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4E50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2A80000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1380000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 7F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2470000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 23C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: C60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2730000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4730000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1390000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2F20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4F20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1810000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3230000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 5230000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: B10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2560000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: BA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 25E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2790000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 4790000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 11E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2D00000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 11E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 15C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 32D0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 3210000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 1340000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2E90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Memory allocated: 2B10000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Code function: 14_2_604AE130 rdtsc

14_2_604AE130

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 439	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 1060	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 952	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 3735	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 883	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 860	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\log4net.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Del.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsjB8F5.tmp\liteFirewall.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libcef.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\INetC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\nsProcess.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\blowfish.dll	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

API coverage: 3.7 %

Source: C:\Windows\explorer.exe TID: 4628	Thread sleep time: -106000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6352	Thread sleep time: -95200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4628	Thread sleep time: -373500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe TID: 3396	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 5576	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe TID: 6768	Thread sleep count: 32 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B7256E FindFirstFileExW,FindNextFileW,FindClose,FindClose,	9_2_00B7256E
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03951000 FindFirstFileW,FindNextFileW,EnterCriticalSection,LeaveCriticalSection,	9_2_03951000
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03954E27 FindFirstFileW,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,	9_2_03954E27
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03951D3C FindFirstFileW,FindNextFileW,	9_2_03951D3C
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_039540BA FindFirstFileW,FindNextFileW,	9_2_039540BA
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_03953EFC FindFirstFileW,FindNextFileW,	9_2_03953EFC
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_00405B4A CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	11_2_00405B4A
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004066FF FindFirstFileA,FindClose,	11_2_004066FF
Source: C:\Users\user\AppData\Local\Temp\setup.exe	Code function: 11_2_004027AA FindFirstFileA,	11_2_004027AA
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6051EA80 FindFirstFileExW,	14_2_6051EA80
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604EF346 FindFirstFileExW,	14_2_604EF346
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604EF3F7 FindFirstFileExW,RevokeDragDrop,FindNextFileW,FindClose,FindClose,	14_2_604EF3F7
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6051F490 FindFirstFileExW,	14_2_6051F490

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_03952054 GetCurrentHwProfileA,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,

9_2_03952054

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Thread delayed: delay time: 600000

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\	Jump to behavior

Source: explorer.exe, 00000001.00000000.1846766557.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1846263087.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000001.00000000.1844365188.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 00000001.00000000.1846766557.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000001.00000000.1843056048.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000001.00000000.1846766557.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 00000001.00000000.1846263087.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: explorer.exe, 00000001.00000000.1846263087.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2306543149.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309021449.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2234378949.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2306543149.00000000016D7000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264120478.0000000001701000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2223257274.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2235294827.0000000001700000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264560521.0000000001706000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000001.00000000.1846766557.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000001.00000000.1844365188.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000001.00000000.1846263087.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000001.00000000.1843056048.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000001.00000000.1843056048.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\setup.exe

API call chain: ExitProcess graph end node

graph_11-3649

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Code function: 14_2_604AE130 rdtsc

14_2_604AE130

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_00B64383 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

9_2_00B64383

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

9_2_00B05B80

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_024F092B mov eax, dword ptr fs:[00000030h]	0_2_024F092B
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_024F0D90 mov eax, dword ptr fs:[00000030h]	0_2_024F0D90
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Code function: 0_2_025B42CF push dword ptr fs:[00000030h]	0_2_025B42CF
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_02473F2F push dword ptr fs:[00000030h]	5_2_02473F2F
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_03F90D90 mov eax, dword ptr fs:[00000030h]	5_2_03F90D90
Source: C:\Users\user\AppData\Roaming\wdugfia	Code function: 5_2_03F9092B mov eax, dword ptr fs:[00000030h]	5_2_03F9092B

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_00B75891 GetProcessHeap,

9_2_00B75891

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B64383 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00B64383
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B60495 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00B60495
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B606F0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_00B606F0
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: 9_2_00B60622 SetUnhandledExceptionFilter,	9_2_00B60622
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604CE18A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_604CE18A
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_60513120 GetCurrentProcessId,SetUnhandledExceptionFilter,AddVectoredExceptionHandler,	14_2_60513120
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604EB5D6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_604EB5D6
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_6047BC40 GetCurrentProcessId,CreateEventW,CreateEventW,CreateEventW,CreateEventW,SetUnhandledExceptionFilter,AddVectoredExceptionHandler,CreateThread,	14_2_6047BC40
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: 14_2_604CDC6C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_604CDC6C

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: 2DF0.exe.1.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 77.221.157.163 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 141.8.194.149 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 190.147.2.86 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 188.114.97.3 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 186.101.193.110 80	Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Thread created: C:\Windows\explorer.exe EIP: 87C19A0			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Thread created: unknown EIP: 31619A0			Jump to behavior

LummaC encrypted strings found

Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: pedestriankodwu.xyz
Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: towerxxuytwi.xyz
Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: ellaboratepwsz.xyz
Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: penetratedpoopp.xyz
Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: swellfrrgwwos.xyz
Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: contintnetksows.shop
Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: foodypannyjsud.shop
Source: E636.exe, 00000006.00000002.2307553839.00000000007DD000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: potterryisiw.shop

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\5GOuTtZoQn.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wdugfia	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3308 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3528 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3664 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077579277 --mojo-platform-channel-handle=3760 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077667358 --mojo-platform-channel-handle=4152 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3308 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3528 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3664 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077579277 --mojo-platform-channel-handle=3760 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077667358 --mojo-platform-channel-handle=4152 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3308 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:2
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-us --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3528 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-us --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --lang=en-us --user-data-dir="c:\users\user\appdata\local\cef\user data" --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --mojo-platform-channel-handle=3664 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --user-data-dir="c:\users\user\appdata\local\cef\user data" --first-renderer-process --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077579277 --mojo-platform-channel-handle=3760 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Process created: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe "c:\users\user\appdata\roaming\gamepall\gamepall.exe" --type=renderer --log-severity=disable --user-agent="mozilla/5.0 (iphone; cpu iphone os 17_5_1 like mac os x) applewebkit/605.1.15 (khtml, like gecko) fxios/127.1 mobile/15e148 safari/605.1.15" --user-data-dir="c:\users\user\appdata\local\cef\user data" --no-sandbox --log-file="c:\users\user\appdata\roaming\gamepall\debug.log" --lang=en-us --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077667358 --mojo-platform-channel-handle=4152 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=backforwardcache,calculatenativewinocclusion,documentpictureinpictureapi /prefetch:1

Source: explorer.exe, 00000001.00000000.1843280785.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1844210009.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000001.00000000.1843280785.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000001.00000000.1843056048.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000001.00000000.1843280785.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000001.00000000.1843280785.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_00B6013C cpuid

9_2_00B6013C

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: GetLocaleInfoW,	9_2_00B6E096
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_00B750DC
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: EnumSystemLocalesW,	9_2_00B75051
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: GetLocaleInfoW,	9_2_00B7532F
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00B75458
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: GetLocaleInfoW,	9_2_00B7555E
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00B75634
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: EnumSystemLocalesW,	9_2_00B6DBC7
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: EnumSystemLocalesW,	9_2_00B74FB6
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: EnumSystemLocalesW,	9_2_00B74F6B
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	Code function: EnumSystemLocalesW,	9_2_00B74F69
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: GetLocaleInfoW,	14_2_604EA48C
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	14_2_604EE797
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: EnumSystemLocalesW,	14_2_604EA9CD
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: EnumSystemLocalesW,	14_2_604EE9E8
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	14_2_604EEA90
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: EnumSystemLocalesW,	14_2_604EECE3
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: GetLocaleInfoW,	14_2_604EED50
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: GetLocaleInfoW,	14_2_604EEE70
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: EnumSystemLocalesW,	14_2_604EEE25
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	14_2_604EEF17
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Code function: GetLocaleInfoW,	14_2_604EF01D

Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\log4net.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Code function: 14_2_6048B950 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,CreateNamedPipeW,

14_2_6048B950

Source: C:\Users\user\AppData\Local\Temp\2DF0.exe

Code function: 9_2_00B6038F GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

9_2_00B6038F

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Code function: 14_2_604F1043 GetTimeZoneInformation,

14_2_604F1043

Source: C:\Users\user\AppData\Local\Temp\setup.exe

11_2_004034CC

Source: C:\Users\user\AppData\Local\Temp\E636.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: E636.exe, 00000006.00000003.2285339247.0000000001783000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285485743.0000000001793000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2279914840.0000000001783000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2280086015.0000000001793000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2306412098.000000000179A000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309520806.000000000179A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\E636.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\AD6.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E636.exe PID: 4476, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 9.2.2DF0.exe.1276b20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.12cc9c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.3950000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.12cc9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.3950000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.1276b20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2DF0.exe PID: 7024, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum-LTC
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.walletc"
Source: E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binancec
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: E636.exe, 00000006.00000003.2285575589.0000000001757000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore@#v

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2DF0.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\E636.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E636.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior

Source: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Directory queried: number of queries: 1248

Source: Yara match	File source: 00000006.00000003.2234378949.000000000175F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2236092761.000000000175F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2234378949.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2264120478.0000000001701000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2212422021.000000000175F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2235294827.0000000001700000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2264560521.0000000001706000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2232951408.000000000175F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2236092761.0000000001700000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2235294827.000000000175F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2247835335.0000000001700000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E636.exe PID: 4476, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: E636.exe PID: 4476, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 9.2.2DF0.exe.1276b20.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.12cc9c0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.3950000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.12cc9c0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.3950000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.2DF0.exe.1276b20.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2DF0.exe PID: 7024, type: MEMORYSTR

Yara detected SmokeLoader

Source: Yara match	File source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	1 Windows Service	1 Access Token Manipulation	111 Deobfuscate/Decode Files or Information	LSASS Memory	23 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Windows Service	41 Obfuscated Files or Information	Security Account Manager	137 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	313 Process Injection	21 Software Packing	NTDS	661 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	241 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	241 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	313 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5GOuTtZoQn.exe	61%	ReversingLabs	Win32.Trojan.SmokeLoader
5GOuTtZoQn.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\E636.exe	100%	Avira	HEUR/AGEN.1313486
C:\Users\user\AppData\Local\Temp\setup.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Temp\AD6.exe	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Avira	HEUR/AGEN.1352426
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	100%	Avira	HEUR/AGEN.1359405
C:\Users\user\AppData\Local\Temp\2DF0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E636.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\Del.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\2DF0.exe	54%	ReversingLabs	Win32.Trojan.PovertyStealer
C:\Users\user\AppData\Local\Temp\AD6.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\E636.exe	68%	ReversingLabs	Win32.Trojan.Smokeloader
C:\Users\user\AppData\Local\Temp\nsjB8F5.tmp\liteFirewall.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\INetC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\blowfish.dll	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\nsProcess.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\setup.exe	3%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\GamePall\Del.exe	7%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\libcef.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\log4net.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\wdugfia	61%	ReversingLabs	Win32.Trojan.SmokeLoader

Name	Malicious	Antivirus Detection	Reputation
contintnetksows.shop	true
http://qeqei.xyz/tmp/	true
ellaboratepwsz.xyz	true
swellfrrgwwos.xyz	true
foodypannyjsud.shop	true
pedestriankodwu.xyz	true
http://lindex24.ru/tmp/	true
http://llcbc.org/tmp/	true

URLs from Memory and Binaries

Name	Source	Malicious
https://chrome.google.com/webstore?hl=vi&category=theme81https://myactivity.google.com/myactivity/?u	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/odirmr	explorer.exe, 00000001.00000000.1844365188.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false
https://duckduckgo.com/chrome_newtab	E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/s	E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264750383.000000000176F000.00000004.00000020.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/t	E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264750383.000000000176F000.00000004.00000020.00020000.00000000.sdmp	false
https://chrome.google.com/webstore?hl=hiCtrl$1	hi.pak.11.dr	false
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICEN	GamePall.exe	false
https://support.google.com/chrome/answer/6098869	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	false
https://www.google.com/chrome/privacy/eula_text.html	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, hi.pak.11.dr, bg.pak.11.dr	false
https://foodypannyjsud.shop/ldOL	E636.exe, 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp	false
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000001.00000000.1846263087.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	E636.exe, 00000006.00000003.2237638501.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	false
http://logging.apache.org/log4net/release/faq.html#trouble-EventLog	GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp, log4net.xml.11.dr	false
https://chrome.google.com/webstore?hl=itCtrl$1	it.pak.11.dr	false
https://excel.office.com	explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/k	E636.exe, 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/apins	E636.exe, 00000006.00000003.2285575589.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2280247691.0000000001766000.00000004.00000020.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/s.S	E636.exe, 00000006.00000003.2263990356.000000000176C000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2264750383.000000000176F000.00000004.00000020.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/P	E636.exe, 00000006.00000003.2232951408.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	false
https://photos.google.com/settings?referrer=CHROME_NTP	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	false
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	E636.exe, 00000006.00000003.2237638501.00000000016E2000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false
https://chromeenterprise.google/policies/#BrowserSwitcherExternalGreylistUrl	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	false
https://foodypannyjsud.shop/pim	E636.exe, 00000006.00000003.2212422021.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2223257274.00000000016FE000.00000004.00000020.00020000.00000000.sdmp	false
https://passwords.google.com	bg.pak.11.dr	false
https://aui-cdn.atlassian.com/	2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false
http://www.iana.org/assignments/multicast-addresses	log4net.xml.11.dr	false
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000001.00000000.1848132573.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/la	E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	false
https://chromestatus.com/features#browsers.chrome.status%3A%22Deprecated%22	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	false
http://bageyou.xyz	GamePall.exe, 00000012.00000002.3683666966.0000000002261000.00000004.00000800.00020000.00000000.sdmp	false
http://logging.apache.org/log4ne	GamePall.exe	false
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://bitbucket.org/	2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000001.00000000.1844365188.00000000079B1000.00000004.00000001.00020000.00000000.sdmp	false
https://wns.windows.com/L	explorer.exe, 00000001.00000000.1848132573.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false
http://www.connectionstrings.com/	log4net.xml.11.dr	false
https://word.office.com	explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false
https://support.google.com/chromebook?p=app_intent	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	false
https://web-security-reports.services.atlassian.com/csp-rep	2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://chrome.google.com/webstore	resources.pak.11.dr	false
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://chrome.google.com/webstore?hl=en&category=theme81https://myactivity.google.com/myactivity/?u	GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.rootca1.amazontrust.com/rootca1.crl0	E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	false
http://ocsp.rootca1.amazontrust.com0:	E636.exe, 00000006.00000003.2235658255.0000000003E0E000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000003.2979074721.000000000AA5F000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	E636.exe, 00000006.00000003.2212749407.0000000003E4C000.00000004.00000800.00020000.00000000.sdmp	false
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
http://nsis.sf.net/NSIS_ErrorError	AD6.exe, 00000008.00000000.2263677389.000000000040A000.00000008.00000001.01000000.00000008.sdmp, setup.exe, 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.3083333890.000000000040A000.00000008.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000003.3371912395.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	false
http://logging.apache.org/log4j	log4net.xml.11.dr	false
https://chrome.google.com/webstore?hl=hi&category=theme81https://myactivity.google.com/myactivity/?u	hi.pak.11.dr	false
https://www.ecosia.org/newtab/	E636.exe, 00000006.00000003.2213042327.0000000003E1F000.00000004.00000800.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2213129167.0000000003E08000.00000004.00000800.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2989495989.000000000A341000.00000004.00000020.00020000.00000000.sdmp	false
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
http://xiexie.wf/22_551/huge.dat	AD6.exe, 00000008.00000003.2266842133.0000000003070000.00000004.00001000.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/0Hx	E636.exe, 00000006.00000003.2306543149.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2307179911.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309225728.000000000175F000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	E636.exe, 00000006.00000003.2237221082.0000000003F1B000.00000004.00000800.00020000.00000000.sdmp	false
https://bitbucket.org/fcsdcvscvc/sadcasdv/raw/62af221cbc4d137cf4e95f7d66f3ced90597b434/kupee	2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp, 2DF0.exe, 00000009.00000002.2987292224.0000000001200000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://chromeenterprise.google/policies/#BrowserSwitcherExternalSitelistUrl	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, GamePall.exe, 0000000E.00000002.3479833750.00000000063D0000.00000002.00000001.00040000.0000001C.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	false
http://nsis.sf.net/NSIS_Error	setup.exe, setup.exe, 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000000.3083333890.000000000040A000.00000008.00000001.01000000.0000000E.sdmp, setup.exe, 0000000B.00000003.3371912395.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	false
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/apiP	E636.exe, 00000006.00000003.2306543149.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285575589.0000000001757000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000002.2309359717.0000000001767000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2306987140.0000000001764000.00000004.00000020.00020000.00000000.sdmp	false
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/apids	E636.exe, 00000006.00000003.2280247691.0000000001766000.00000004.00000020.00020000.00000000.sdmp	false
https://android.notify.windows.com/iOS	explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false
http://api.install-stat.debug.world/clients/installs	GamePall.exe, 0000000E.00000002.3470666729.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	false
https://foodypannyjsud.shop/jh5S	E636.exe, 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp	false
https://support.microsof	E636.exe, 00000006.00000003.2212749407.0000000003E4E000.00000004.00000800.00020000.00000000.sdmp	false
https://cdn.cookielaw.org/	2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false
https://www.newtonsoft.com/jsonschema	Newtonsoft.Json.dll.11.dr	false
https://support.google.com/chrome/a/answer/9122284	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp, hi.pak.11.dr, bg.pak.11.dr, it.pak.11.dr	false
https://foodypannyjsud.shop/F9	E636.exe, 00000006.00000003.2279914840.0000000001777000.00000004.00000020.00020000.00000000.sdmp, E636.exe, 00000006.00000003.2285339247.000000000176C000.00000004.00000020.00020000.00000000.sdmp	false
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false
https://outlook.com_	explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false
https://www.google.com/	resources.pak.11.dr	false
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000001.00000000.1844365188.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false
https://chrome.google.com/webstore?hl=zh-CN&category=theme81https://myactivity.google.com/myactivity	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	false
https://chrome.google.com/webstore?hl=zh-CNCtrl$1	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	false
https://svn.apache.org/repos/asf/logging/log4net/tags/2.0.8RC1	GamePall.exe, GamePall.exe, 0000000E.00000002.3473718724.0000000004E76000.00000002.00000001.01000000.00000012.sdmp, GamePall.exe, 0000000E.00000002.3473498425.0000000004E32000.00000002.00000001.01000000.00000012.sdmp	false
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000001.00000000.1844365188.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false
http://www.unicode.org/copyright.html	GamePall.exe, 0000000E.00000002.3475253670.0000000005F57000.00000002.00000001.00040000.0000001B.sdmp	false
https://powerpoint.office.comcember	explorer.exe, 00000001.00000000.1848132573.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false
https://chrome.google.com/webstore?hl=zh-TW&category=theme81https://myactivity.google.com/myactivity	setup.exe, 0000000B.00000002.3769420567.0000000002735000.00000004.00000020.00020000.00000000.sdmp	false
https://bitbucket.org/fcsdcvscvc/sadcasdv/raw/62af221cbc4d137cf4e95f7d66f3ced90597b434/kupeeC	2DF0.exe, 00000009.00000002.2987292224.000000000124D000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
77.221.157.163	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	true
104.192.141.1	unknown	United States	16509	AMAZON-02US	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	true
186.101.193.110	unknown	Ecuador	27947	TelconetSAEC	true
141.8.194.149	unknown	Russian Federation	35278	SPRINTHOSTRU	true
172.67.221.174	unknown	United States	13335	CLOUDFLARENETUS	false
190.147.2.86	unknown	Colombia	10620	TelmexColombiaSACO	true
146.70.169.164	unknown	United Kingdom	2018	TENET-1ZA	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466817
Start date and time:	2024-07-03 13:26:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 18m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	5GOuTtZoQn.exe renamed because original name is a hash value
Original Sample Name:	7fc4847438a3867ab9380525626d0cece5f31bd4d148864e4168616c182f7b6e.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@240/115@0/8
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 62% Number of executed functions: 185 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Connection to analysis system has been lost, crash info: Unknown
Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Execution Graph export aborted for target E636.exe, PID 4476 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: 5GOuTtZoQn.exe

Simulations

Behavior and APIs

Time	Type	Description
07:27:27	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
07:27:27	API Interceptor	156016x Sleep call for process: explorer.exe modified
07:27:50	API Interceptor	9x Sleep call for process: E636.exe modified
07:29:53	API Interceptor	1x Sleep call for process: GamePall.exe modified
12:27:33	Task Scheduler	Run new task: Firefox Default Browser Agent 9702C14AC0E093F2 path: C:\Users\user\AppData\Roaming\wdugfia
12:29:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
12:30:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GamePall C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Process:	C:\Users\user\AppData\Local\Temp\AD6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2DF0.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	578048
Entropy (8bit):	6.297510031778876
Encrypted:	false
SSDEEP:	12288:No4ykJuqlLJop9G3/AmAGWn7sfPJYQIMt8KHsTH:NoBsLaDKAmAbUJ+M2K2
MD5:	DA4B6F39FC024D2383D4BFE7F67F1EE1
SHA1:	7CC975D9FF785E269163897907D0B9B3CEE29956
SHA-256:	544697A024ABAEA1B24EAA3D89869B2C8A4C1ACF96D4E152F5632D338D054C9E
SHA-512:	D73CC4D911D9E61711B97CB9212D5BC93CB1B1314A39945934EB92239A31728FCCA7FEFBEC0143BAD915B0A7A6B93DF11D0AB7F559737AA7EC920BD24243FFFE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........(...I..I..I...1..I...1...I...1..I..l...I..l...I..l....I...1..I..I...I..]...I..]...I..Rich.I..................PE..L...w;.f...............'.....\....................@.......................................@.....................................(................................2..Xh..p....................i.......g..@...............@............................text....~.......................... ..`.rdata..4...........................@..@.data...............................@....reloc...2.......4..................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AD6.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	293869
Entropy (8bit):	5.61569579822855
Encrypted:	false
SSDEEP:	3072:lFi6z/VXzAf3ocMNqB3r1Josf+OMhERMlm+twHBumSYyDgIoIPM7l0UGHM7:lxFSIjs+OM2eLFmSFgIZk7+HM7
MD5:	60172CA946DE57C3529E9F05CC502870
SHA1:	DE8F59D6973A5811BB10A9A4410801FA63BC8B56
SHA-256:	42CEB2252FEC41FD0ACC6874B41C91E0BA07C367045D6A9A7850D59781C2584C
SHA-512:	15D37AF3CAB96FC9026A1898E09C775FE0D277098A3FE20C2E591272DE996A243850D43F3B48B4C037C5FED359E57795A7CF1652547D7AD8B16B186AB9508792
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........`..X............................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...X....`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E636.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6642176
Entropy (8bit):	7.866419732571782
Encrypted:	false
SSDEEP:	98304:LqhZ67opwYckx35SF2XKgxVvHuCPU8GSbO3JAXV1LrA+ZlL9CxpzTp2:LgErupSgKORuCT43JeV1LE+/s3p
MD5:	BD2EAC64CBDED877608468D86786594A
SHA1:	778AD44AFD5629F0A5B3B7DF9D6F02522AE94D91
SHA-256:	CAE992788853230AF91501546F6EAD07CFD767CB8429C98A273093A90BBCB5AD
SHA-512:	3C8F43045F27ADDCB5FB23807C2CE1D3F247CC30DD1596134A141B0BBC7FA4D30D138791214D939DC4F34FD925B9EC450EA340E5871E2F4F64844226ED394312
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....U~f..............................M...........@...................................e...@..................................O......P......................@.......................................................@3..............................text...+........................... ..`.rdata...*..........................@..@.data.... ..........................@....vmpL.p.....0...................... ..`.vmpL.p@....@3.....................@....vmpL.p..]..P3...]................. ..`.reloc.......@........].............@..@.rsrc.......P...f....].............@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg4CAD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	358363995
Entropy (8bit):	6.972150585647623
Encrypted:	false
SSDEEP:	3145728:KTzytRGD/CYRNIPKYTFBhfmOS9KBaVzTx9OSsKV97nM:KnUs4tvaVzTD99M
MD5:	5F9D89B40243E83C0B48206CE4EB77D1
SHA1:	477A019AB11E5793168B3E41D83B80A8AC8F1D43
SHA-256:	2BF31800E731EF63E7E5BDEECD87B50B349EC8F5C9D752AACB807AC0E82E95B9
SHA-512:	5B812C2D341FE8A9296EF68E416E0EFA8185FB3ECCEC0917AB206CD7639E1810E6444538B61583E2260F1A46D4209E1995CFBF940A1D9836C4155ADF0504940B
Malicious:	false
Reputation:	unknown
Preview:	........,.......................H...........................................................................................................................................................................................................................................................e...i...............j.......................3.......................................................................................................................t....V..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsjB8F5.tmp\liteFirewall.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.389604568119155
Encrypted:	false
SSDEEP:	1536:Dli3i1jKfTV0LzYpAzMk2nACScLw5jPAT:j9KLQ+ScLw5jPAT
MD5:	165E1EF5C79475E8C33D19A870E672D4
SHA1:	965F02BFD103F094AC6B3EEF3ABE7FDCB8D9E2A5
SHA-256:	9DB9C58E44DFF2D985DC078FDBB7498DCC66C4CC4EB12F68DE6A98A5D665ABBD
SHA-512:	CD10EAF0928E5DF048BF0488D9DBFE9442E2E106396A0967462BEF440BF0B528CDF3AB06024FB6FDAF9F247E2B7F3CA0CEA78AFC0CE6943650EF9D6C91FEE52A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W=.e9n.e9n.e9n...n.e9n...n.e9n..Bn.e9n.e8n.e9n.7.n.e9n...n.e9n...n.e9n...n.e9nRich.e9n........PE..L...,.N...........!.........^.......%...............................................3..................................`...$'..d....`.......................p...................................... ...@...............h............................text...1........................... ..`.rdata..P/.......0..................@..@.data........0......................@....rsrc........`.......*..............@..@.reloc.......p.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\INetC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\AD6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.668346578219837
Encrypted:	false
SSDEEP:	384:VpOSdCjDyyvBwRlX+ODbswYM2s74NS0v0Ac9khYLMkIX0+Gzyekx:rdCjW/lX1PfYM2X1
MD5:	92EC4DD8C0DDD8C4305AE1684AB65FB0
SHA1:	D850013D582A62E502942F0DD282CC0C29C4310E
SHA-256:	5520208A33E6409C129B4EA1270771F741D95AFE5B048C2A1E6A2CC2AD829934
SHA-512:	581351AEF694F2489E1A0977EBCA55C4D7268CA167127CEFB217ED0D2098136C7EB433058469449F75BE82B8E5D484C9E7B6CF0B32535063709272D7810EC651
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....I6V...........!.....8...P......Q?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data...<<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\blowfish.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\AD6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22528
Entropy (8bit):	6.674611218414922
Encrypted:	false
SSDEEP:	384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5:	5AFD4A9B7E69E7C6E312B2CE4040394A
SHA1:	FBD07ADB3F02F866DC3A327A86B0F319D4A94502
SHA-256:	053B4487D22AACF8274BAB448AE1D665FE7926102197B47BFBA6C7ED5493B3AE
SHA-512:	F78EFE9D1FA7D2FFC731D5F878F81E4DCBFAF0C561FDFBF4C133BA2CE1366C95C4672D67CAE6A8BD8FCC7D04861A9DA389D98361055AC46FC9793828D9776511
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................6..........dD.......P....@.....................................................................Y.......................................p...................................................................................CODE....\|4.......6.................. ..`DATA....8....P.......:..............@...BSS..........p.......L...................idata...............L..............@....edata..Y............P..............@..P.reloc..p............R..............@..P.rsrc................V..............@..P.....................X..............@..P................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\nsProcess.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\AD6.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	4.666004851298707
Encrypted:	false
SSDEEP:	48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
MD5:	FAA7F034B38E729A983965C04CC70FC1
SHA1:	DF8BDA55B498976EA47D25D8A77539B049DAB55E
SHA-256:	579A034FF5AB9B732A318B1636C2902840F604E8E664F5B93C07A99253B3C9CF
SHA-512:	7868F9B437FCF829AD993FF57995F58836AD578458994361C72AE1BF1DFB74022F9F9E948B48AFD3361ED3426C4F85B4BB0D595E38EE278FEE5C4425C4491DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........s.I...I...I...n\|f.L...I...Q...@..K...@..H...@..H...RichI...........PE..L...`..N...........!......................... ...............................`.......................................#....... ..<....@.......................P..\|.................................................... ..`............................text............................... ..`.rdata....... ......................@..@.data... ....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\AD6.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	107232830
Entropy (8bit):	7.999946456161068
Encrypted:	true
SSDEEP:	1572864:6F6Q78DDbO8pDfwpK5ZAQ5WKor2G5N6Y7ZxFo9jk7WUTLECglga1R7P435MZZDXA:jPNVfsQZoL5NJdo9jKWergS89P4qZZc
MD5:	FF2293FBFF53F4BD2BFF91780FABFD60
SHA1:	61A9EDCF46228DC907AD523AA6FD035CC26C9209
SHA-256:	B9BC473FC866909F089E005BAF2537EE7FF2825668D40D67C960D5C2AFB34E9F
SHA-512:	C31A0046BA580926097422DF34619B614AA0DEB6435EC5CE68A553846FAD15BC61908B8C8292D25EE061BA1974637A7B91D72F19CCCCC2C76B9AC737B1CB4A5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	modified
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\DawnCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	8.736218952347586E-4
Encrypted:	false
SSDEEP:	3:LsNl63st:Ls3cst
MD5:	BE6E950CE9A805BDA11B408CFF237135
SHA1:	BD6846156686D325DAA24432D22B4259BC61539E
SHA-256:	7D3E8228A604D356952117E8E8A3A63C0EEDF371FAADC55DCBE4C1603F1B9607
SHA-512:	F93BF3C767697DBECC373811C6A8FAF8D472DCC4EF22E6881A17ED36999A7C382DFEEAF333EE5800E45C165242A565E7C8DE0BADCC87D9B72CE5934C9F323DB7
Malicious:	false
Reputation:	unknown
Preview:	.............................................z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Del.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.622398838808078
Encrypted:	false
SSDEEP:	96:QPjzIyfbInD3W0IwrBmEH7UewW4ORIhmY5XO40uK8DDzNt:pQIS0IwrJbU7W4kIX5e4kgF
MD5:	97D4D47D539CB8171BE2AEFD64C6EBB1
SHA1:	44ABF82DD553CCE0C1F41B9B78D853075DDD1F16
SHA-256:	8D996D5F68BF2248F223C4F3549303BC6A8EC58CC97FCB63B7BB7D8068850273
SHA-512:	7D402847B093E208410C695095DE815A3F5D5DA81630FD51C88C009C48C269D0EA5016D626351BB9D38862163FAD930645072C50ACCCD743DC0E19531A592FDE
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....&.].........."...0.............64... ...@....@.. ....................................@..................................3..O....@.......................`.......2............................................... ............... ..H............text...<.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........#...............1...............................................0..-.......(....r...p(.....(.......(....,...(....(........0..T........~....(.....~....(.....(....s....%.o....%.o....%.o....%.o....%~....o....(....&..&..........PP.......0..6.......(....(......( ...r...p~....r...p(!.....("...,...(#......0..........r...p.~$.....o%.....,..~....o&......,..o'....ra..p.~$.....o%.....,..~....o(......,..o'....r...p.~$.....o%.....,..~....o(......,..o'......&..*....4.......#..

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_0

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_1

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012096502606932763
Encrypted:	false
SSDEEP:	3:MsEllllkXl:/M/6
MD5:	259E7ED5FB3C6C90533B963DA5B2FC1B
SHA1:	DF90EABDA434CA50828ABB039B4F80B7F051EC77
SHA-256:	35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
SHA-512:	9D401053AC21A73863B461B0361DF1A17850F42FD5FC7A77763A124AA33F2E9493FAD018C78CDFF63CA10F6710E53255CE891AD6EC56EC77D770C4630F274933
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_2

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\data_3

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GPUCache\index

Download File

Process:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNljj3R+/:Ls3M/
MD5:	E8821D8716533DCB4137DCA7389B800C
SHA1:	ECFF0AED90107735857D12D25795BD6FB220329D
SHA-256:	2190E484A5CADAFBD5320258E72C2F84B5F6427F2287C416DC14198610F86521
SHA-512:	6E0ED4C49D4CBF1381B976550868A9D94B31BBBF8635A555EE5F5E5E678C5E822704308566EF4140E73A7FC576FEC8742595985441D0F50854AAE3CC0B3BE2FB
Malicious:	false
Reputation:	unknown
Preview:	...........................................z/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	296448
Entropy (8bit):	5.660420770467009
Encrypted:	false
SSDEEP:	3072:xTpjI4TptgvmHMaellnhblkK0m2QEk0xjo4OVzdvayfvYn6A:ppbVtsg1e5b2Px2zdyyq
MD5:	7A3502C1119795D35569535DE243B6FE
SHA1:	DA0D16BC66614C7D273C47F321C5EE0652FB5575
SHA-256:	B18FEFB56ED7B89E45CEC8A5494FBEC81E36A5CB5538CCBB8DE41CCE960FAA30
SHA-512:	258B111AC256CD8145CBE212D59DFF5840D67E70EFFD7CDDC157B2A3461B398BBC3446004980131FAA6A8762C19305F56E7B793F045331B56B8BD17D85B884C4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....rf..............0.............>.... ........@.. ....................................@....................................O.......t............................................................................ ............... ..H............text...d.... ...................... ..`.rsrc...t...........................@..@.reloc..............................@..B................ .......H....... ...$...........D...p............................................(....s....Z..(....,...(....(.....(......(......(............~........0..W.......(....".....(......,..o....-...o.....+...( .....o....&..(!...-...........o"....."...BZ.......%..A.......0..Q.......(....(........,..o....-...o.....+...( .....o....&.._...(!...-...........o"..............!. A.......0..V.......(....(......,..o....-.~#.....o.....+...( ...."...B[..o....&..(!...-...........o"....*......

C:\Users\user\AppData\Roaming\GamePall\Ionic.Zip.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	462336
Entropy (8bit):	6.803831500359682
Encrypted:	false
SSDEEP:	6144:leSYvQAd10GtSV41OJDsTDDVUMle6ZjxLV/rHo0Oaaz2R9IY:oJBdBS4msNUCe65frHMnz2R9
MD5:	6DED8FCBF5F1D9E422B327CA51625E24
SHA1:	8A1140CEBC39F6994EEF7E8DE4627FB7B72A2DD9
SHA-256:	3B3E541682E48F3FD2872F85A06278DA2F3E7877EE956DA89B90D732A1EAA0BD
SHA-512:	BDA3A65133B7B1E2765C7D07C7DA5103292B3C4C2F0673640428B3E7E8637B11539F06C330AB5D0BA6E2274BD2DCD2C50312BE6579E75C4008FF5AE7DAE34CE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=N...........!................N#... ...@....@.. ..............................T.....@.................................."..O....@..P....................`......."............................................... ............... ..H............text...T.... ...................... ..`.rsrc...P....@......................@..@.reloc.......`......................@..B................0#......H.......0U..l...........P%.../..P ......................................6..`N.?O...%.C.k_..d...I......5a.......9x......R...gg8...JM...`.[. .o..eE1$_.M.h.q.oz..1..........@....s.c/J..wk.D.....t..&...(.......0..2........r...p(....}.......}"....(........(.........(......r...p(....}.......}"....(........(......0..j.........o....-..s#...+..}......(......(......}.....(....s....}......}......}......(......%-.&r...p}......j(#...rr!..p.{.....{.....B...(....*..0..A........{..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	574376
Entropy (8bit):	5.8881470355864725
Encrypted:	false
SSDEEP:	12288:ZzfhypmNGgHA37YyUD1AboTf3xnpJbC8VGSBJjRuz7:ZoI1AbQf3xnpJbC8VLBJjRuz7
MD5:	8F81C9520104B730C25D90A9DD511148
SHA1:	7CF46CB81C3B51965C1F78762840EB5797594778
SHA-256:	F1F01B3474B92D6E1C3D6ADFAE74EE0EA0EBA6E9935565FE2317686D80A2E886
SHA-512:	B4A66389BF06A6611DF47E81B818CC2FCD0A854324A2564A4438866953F148950F59CD4C07C9D40CC3A9043B5CE12B150C8A56CCCDF98D5E3F0225EDF8C516F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ot............" ..0.............6.... ........... ....................................@....................................O.......................................T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........f...P............................................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{E....3...{D......(....,...{D.....{F.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Roaming\GamePall\Newtonsoft.Json.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	561424
Entropy (8bit):	4.606896607960262
Encrypted:	false
SSDEEP:	6144:XqqUmk/Rik2rH6dl0/IaHNpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUK
MD5:	928ED37DB61C1E98A2831C8C01F6157C
SHA1:	98103C2133EBDA28BE78BFE3E2D81D41924A23EE
SHA-256:	39F6A4DB1BE658D6BAFF643FA05AAE7809139D9665475BFCA10D37DCA3384F21
SHA-512:	F59387BFA914C7DB234161E31AD6075031ACA17AAEF4B8D4F4B95C78C7A6A8D0E64211566CA2FD4549B9DA45231F57A4191FBCD3809404653F86EE2ABD4937A4
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>Newtonsoft.Json</name>.. </assembly>.. <members>.. <member name="T:Newtonsoft.Json.Bson.BsonObjectId">.. <summary>.. Represents a BSON Oid (object id)... </summary>.. </member>.. <member name="P:Newtonsoft.Json.Bson.BsonObjectId.Value">.. <summary>.. Gets or sets the value of the Oid... </summary>.. <value>The value of the Oid.</value>.. </member>.. <member name="M:Newtonsoft.Json.Bson.BsonObjectId.#ctor(System.Byte[])">.. <summary>.. Initializes a new instance of the <see cref="T:Newtonsoft.Json.Bson.BsonObjectId"/> class... </summary>.. <param name="value">The Oid value.</param>.. </member>.. <member name="T:Newtonsoft.Json.Bson.BsonReader">.. <summary>.. Represents a reader that provides fast, non-cached, forward-only access to s

C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	215862
Entropy (8bit):	5.849338245796311
Encrypted:	false
SSDEEP:	3072:rFi6z/VXzAf3oc8+vat7fvYnDAdOVz5kNx:rxFSI+y1qk6zuNx
MD5:	9D21A25AA1B5985A2C8CBCE7F7007295
SHA1:	86EBF56352B4DBB831FAE0CCA180B4ADD951240D
SHA-256:	E41F984C39183BA4FD1578134D71E203F4A7A8C23F278924562876326FC40EE2
SHA-512:	EE4A1AC97968F2DDA3C54A49AC33D3FCE28C4DAE72032D9FDD1F8D8BA41B07A1D78D15E11586DA54AD5E0F2BD4A48C79A0CBAC84DE3D957B2AC6C1B5F41A33BB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1)..PG..PG..PG._...PG..PF.IPG._...PG.sw..PG..VA..PG.Rich.PG.........PE..L.....Oa.................d...........4............@.......................................@.................................8........................................................................................................................text....c.......d.................. ..`.rdata..v............h..............@..@.data...X............\|..............@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\Xilium.CefGlue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	875520
Entropy (8bit):	5.621956468920589
Encrypted:	false
SSDEEP:	12288:jsRfnBqqvFXWesd2HiZ9fyn+5FHrvUR1Qnzx7LuQ:jsRITeWAQ5vtu
MD5:	B03C7F6072A0CB1A1D6A92EE7B82705A
SHA1:	6675839C5E266075E7E1812AD8E856A2468274DD
SHA-256:	F561713347544E9D06D30F02A3DFCEC5FE593B38894593AEEDF5700666B35027
SHA-512:	19D6792EB9BA8584B94D0D59E07CE9D1C9C4DA5516490F4ABCE5AE0D7D55B357BDA45B2093B3E9EB9D6858061E9D3F530A6655C4779A50C911501AE23925C566
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0..R...........p... ........... ....................................@..................................p..O.......x............................o..T............................................ ............... ..H............text....P... ...R.................. ..`.rsrc...x............T..............@..@.reloc...............Z..............@..B.................p......H....... .................................................................(......(......(....^.(.......=...%...}....:.(......}....:.(......}....^.(.......>...%...}....:.(......}.....(.............0..,.......(....o.......3......... ....3.(....-.....0..L.......~..... . ..(......(....-..(....r...p( ...,.......&...~....(!...,..("..............+1...........4.......~.....~......(.....~....,..(#...-.(....-..(....+.r...ps$...z(..........b.r...p(%...~.....(....&*.r

C:\Users\user\AppData\Roaming\GamePall\cef.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1946739
Entropy (8bit):	7.989700491058983
Encrypted:	false
SSDEEP:	49152:fpXzD2VLpS71ycdao6LreGCL/0jJZWOiBiXkbEia9T:xjyFgZ0Lr2/0jJU5BiIEN
MD5:	96AD47D78A70B33158961585D9154ECC
SHA1:	149BF6F6905A76B0CC9E9ACA580357BD6C3497A2
SHA-256:	C861117D1F1DBF02867B46FA87CB8C65C3213D196029EE81A02B617D131236E2
SHA-512:	6A971F742B5754EEF39C6C2C64DB13DFDCB74D8CB23833404E9EF5AD89E142278E5DF789F508DB561C5E957013AE0C60D002CDFA93BCD87CA4967D610DF1579B
Malicious:	false
Reputation:	unknown
Preview:	........V...f.....g.7........................!.....%....o8...).>...).F...).H...).X...).a...)i...).k...).q...)Lt...).v...)Tw...).x...).}...).....)I....)i....)....).....).....)L....)....)....)t....).....).....).....)s....).... )....!)....")....#)....$)}...%)+...&)h#..').'..().-..)).>..).A..+).C..,).Q..-)CU...).]..<).d..=).l..>)i...?)G...@)H...A)r...B)....C)z...T)....U)....V)+...W)....X)....Y)....Z)....[)#...\)}...]).!..^)R1.._).2..`).;..a).=..b)mE..c)QG..d).H..e)qL..f).U..g).]..h).b..i))d..j).e..k).g..l)Pi..m).p..n).z..s).z...).....)b....).....)'....).....)....)....).....).....)....).....)s....)F....)j....)....).....)....)....)....)h....)H....)....).....).....)k....).....)L....)q....)2....).....).....).....).....).....)N....)\|....).....).....).....).!...).)...).6...).C...)RE...).L...).N...).O...).U...)bV...).W...).^...)o_...)(g...)Si...).v...).....)0....)/....).....),....)..........F....]....3....v........v...................$... ....!8..."....#....$....%*..

C:\Users\user\AppData\Roaming\GamePall\cef_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	214119
Entropy (8bit):	7.955451054538398
Encrypted:	false
SSDEEP:	6144:m5S+8U5mtp0ra7rFrJzw95T9OHCZg0Gb0OveGe04mExhLY:mWU5OGUFoqoORehrQ
MD5:	391F512173ECEC14EB5CE31299858DE1
SHA1:	3A5A41A190C1FB682F9D9C84F500FF50308617FC
SHA-256:	E0F5C754C969CCA0AC4594A6F3F2C23D080A09EEA992AF29E19F4291FD1E0B06
SHA-512:	44D7B9BCB3544C3F5550150EF3522BF6A0B36900695E6A13E44F5616E16A058548189D4FEA4A22248B1CB2B273B0EAA7D559EB2D8F013BED520E4097BD45D800
Malicious:	false
Reputation:	unknown
Preview:	........................#.b...&.....:.g....7.....7.....7.....7\|(...7.-...7t5...7.6...7.9...7s:...7hB...7.E...7.G...7.K...7qN...7.Q...7yR...7.S...7.W...7.\...7.b...7.i...7.k...76m...7Vq...7.r...7.v...7.y...7.{...7.~...7Z....75....7;....7W....7.....7c....7u....7b....7.....7.....7.....7Q....7*....7\....8."...8,)..<FqG..=F7I..>F.L..?F$O..@F.P..AFaQ..BFnT..CF.W..DF.Y..EFJ\..FF.^..MF(b..NF.c..QF.e..RF.f..YFZg..ZF.p..[F.x..\F.{..]F.{...L.\|...L.....L....Ni....N.....NJ....N2....N+....N^....No....N9....NK....N....N1....N$....N....Nh....N.....N.....U.....U.....U.....U.....U.....U[....U.&...Uh(...U?/...U.4...U.:...U.@...U.B...U,G...U.K...U)N...U.R...UF\...U.`...U.b...U.j...U]s...UEt...U.u...U.w...U.z...Uh{...U.}...U#....U.....U^....U.....U\|....U.....U.....U.....U.....U.....U.....U.....U.....U.....U]....U?....U.....U9....U....U.....Um....U<....U!....U.....U.....U....Uq....U3....U!....U.....U....U.....Uu....UJ....U.....U.....U.....U.....U`....U'....U.....U.....Ul....U%....U7....U.....U.....UW.

C:\Users\user\AppData\Roaming\GamePall\cef_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	290001
Entropy (8bit):	7.9670215100557735
Encrypted:	false
SSDEEP:	6144:tS+8U5mtp0ra7rFriDQYaF+9bQHgs4jTlmOHCZVWGMRe8InVXYopym74:CU5OGUFrfs4gs4jTQ6ebVIo374
MD5:	BF59A047984EAFC79E40B0011ED4116D
SHA1:	DF747125F31F3FF7E3DFE5849F701C3483B32C5E
SHA-256:	CD9BE67AA0527F16E309189FA2369E1A2596D0601A7D55C405F8A619F4D095E9
SHA-512:	85A545758E8C89EF47BF11B553C57D23ED7DA6AE89A8BCCB262F509AABE61A1121C3F87EC9200791F2670225BAEECC3C92AED6AFDA86C08CA0FD611DA2E595D2
Malicious:	false
Reputation:	unknown
Preview:	........................#.....&.....:......7.....7.....7.....7.+...7.1...7.8...7.9...7)<...7.=...7xE...7.H...7.J...7'N...7.Q...7.T...7.U...7.W...7.Z...7._...7.e...7.l...7.n...7Fp...7ft...7.v...7)y...7.\|...7.~...7.....7j....7E....7K....7g....7.....7s....7.....7r....7.....7.....7.....7a....7:....7l"...8.%...8<,..<F.J..=F.N..>FtV..?F9\..@Fw_..AFr`..BF0g..CFll..DF\|o..EF.v..FF){..MF....NF...QFf...RF....YF`...ZF...[F....\F....]F....L....L.....L.....N.....N.....N.....N.....N.....N.....N.#...N.&...N.'...N.)...N....N.+...Nv,...N.-...N;r...N.\|...Um....U.....UM....UV....U.....U....UC....U.....U....UM....U.....U.....Um....U.....U.....U.....U.....UQ....U.....U7....U.....U.....Uk....U.....U.....U.....U.....U.....U.....U.....U.....U.....U{....U.....U.....U.....U~&...U.)...U.Q...U.Q...U.V...U.[...U.\...U._...U.`...U?a...U.a...Uic...U.d...U\f...U.g...U.i...U1l...U.p...U.u...U.}...U.....U.....U^....U.....U.....Ux....U....U.....Uy....U6....U.....U....UR....Uq....U.....U.....U_....U.....U.....U..

C:\Users\user\AppData\Roaming\GamePall\cef_extensions.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1305142
Entropy (8bit):	7.99463351416358
Encrypted:	true
SSDEEP:	24576:8AkckSbnVLjWG13xdT0b+SLzRYt2k+lbG9EjJNH/osm22O+EcRfPLP:88zVXWG1hdAKSxY4k5EFNHgvPPLP
MD5:	20DDA02AF522924E45223D7262D0E1ED
SHA1:	378E88033A7083AAC24E6CD2144F7BC706F00837
SHA-256:	8448C2BA10A3D7DC8CA3FB24F580BF99D91F746107B1A06E74932749CC1CAB01
SHA-512:	E71320B2AA0CB52938206EC00187D78274646C4C7D3579B33A0163262C063B7813FE7ACD0D2E5807082ADE772069AA577FED7F594964790C2F7C061CE38467B6
Malicious:	false
Reputation:	unknown
Preview:	........i...f+....i+....l+....m+{...n+q...o+7(..p+.1..q+X3..r+~5..s+aI..t+.]..u+.f..v+Ui..w+'k..x+.l..y+.q..z+.s..{+O{..\|+...}+=...~+.....+....+-....+.....+.....+.....+.....+.....+.....+.....+.....+.....+%....+.....+&(...+.Q...+.Y...+Xe...+Bj...+cv...+.}...+....+H....+....+Q....+l....+I....+.....+ ....+T....+!....+m....+.....+.....+U....+.....+.....+.....+l....+~....+.....+=....+w....+.....+-"...+.(...+.0...+.2...+.4...+.G...+uS...+.....+9....+y....+.....+.....+N....+....+0....+.....+.....+.....+_....+.....+.....+.....+.....+.....+.....+.....+.....+S....7`....7R...(7/...)7.....L.m...LO....L.....Mk....M.....M.....M>....M.....M.....Mq....M.....M.....M\....M.....M.....M.....M.....M.....M.....M.....M.....M.....MO....M.....M.....M.!...M.(...Mf5...M.;...M&E...M.P...M.T...M<]...M.`...M.j.. M.k..!M2v.."M.w..#M.z..$M....%M...&M...'M#...(M@...)M....*M(...+MY...,Mu...-M$....M..../MV...0M;...1Mx...2M....3M....4Mi...5M....6M....7MP...8M"...DM....EM.....Mi....M.~...M.~...Mb....M_....M....M.

C:\Users\user\AppData\Roaming\GamePall\cef_sandbox.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	87182312
Entropy (8bit):	5.477474753748716
Encrypted:	false
SSDEEP:	196608:v0b1XAJ5V8XYcrfCNJsTtU0ZhdYHbgMnn6d25JOcLRiLnIrBcnK0EAeg1GF:78JaNJyZhdE6383rWEAR8
MD5:	FFD456A85E341D430AFA0C07C1068538
SHA1:	59394310B45F7B2B2882D55ADD9310C692C7144F
SHA-256:	F188B96639B5157E64222BB8483D76CD21A99141FC2614EF275E20639C739264
SHA-512:	EB4CB388383CB37B1D89531D560169985A80DF9335F005AFBBFDE56F9031821A933D735138B1086CF81D006E480FF14711A8A95B3DB8A0FD4037AA6EFD926B50
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 1696073295 0 1940897 `...Y..:.t.:.>.:...:...:...:...:...;/..;/..;/..;/..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..;k..@...@...@...@...@...A...A...A...A...A...A...A...A...A...A...A...A...Co..Co..Co..Co..Co..Co..Co..Co..Co..Co..E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...E...G..G..G..G..G..G..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=..H=.

C:\Users\user\AppData\Roaming\GamePall\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	656926
Entropy (8bit):	7.964275415195004
Encrypted:	false
SSDEEP:
MD5:	3404DD2B0E63D9418F755430336C7164
SHA1:	0D7D8540FDC056BB741D9BAF2DC7A931C517C471
SHA-256:	0D3FCA7584613EB1A38BAF971A7DD94F70803FC130135885EC675E83D16A4889
SHA-512:	685D63633DB8A57D84225C2B92C92016E1CE98BA2BF8D3DDACE2EB120B3BCF84C718787D59DB6EC61F34CF91CB651500B4E4FF0AC37AEB89561CDCC586946C80
Malicious:	false
Reputation:	unknown
Preview:	..........+...........................&..........;.....;N....;.....;"....;.....;.....;N....;.....;.....;s....;....;.....;.....;....;4....;.....;.....;0....;.....;c....;7....;.....;.....;.....;.....;?....;:....;G....;.....;n....;x....;.....;.....;.....;#....;.....;.....;B....;.....;.....;.....;N....;.....;.....;+....;.....;% ...;c!...;.!...;."...;E+...;t4...;qH...;I\...;.]...;.^...;>a...;.c...;.g...;.o...;pw...;.\|...;h....;.....;.....;....;.....;....;o....;.....;.....;.....;....;y....;.....;.....;3....;9....;h....;.....;.....;.....;F....;."...;.+...;.0...;.8...;?:...;'X...;.q...;.....;....;.....;t....;.....;.....;.....;./...;.X...; m...;....;.....;.....;.....;+....;.....<O....<.....<.....<=....<2$...<y+...<.3...<.<...<aA...<.L...<.W...<.[...<._...<.d...<Dv...<t....<!....<....<....<.....<.....<.....<V....<.....<.#...<.8...<\|F...<hP...<bW.. <i^..!<ts.."<(...#<{...)<`...<c...+<d...,<"...;<x...<<k...=<....><-...?<....@<....A<'...B<g...C<....D<U...E<....F<....G<....J<....K<....L<v%

C:\Users\user\AppData\Roaming\GamePall\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1017158
Entropy (8bit):	7.951759131641406
Encrypted:	false
SSDEEP:
MD5:	3FBF52922588A52245DC927BCC36DBB3
SHA1:	EF3C463C707A919876BF17C3E1CD05C0D2C28CA9
SHA-256:	C6FE346106C5E4950161ED72EB0A81FE3537A94E4A59461AAF54E750D1904F76
SHA-512:	682EB6D61B564C878FDB971A6439FCDA9F1E108BD021A32E8990B68B1338986A4866A0965DEA62567501C8826D43CEBF2B7C8BE8323DE415A75E8D89A9D592E7
Malicious:	false
Reputation:	unknown
Preview:	..........+.....................b................;.....;&....;.....;.....;.....;.....;b....;....;8....;.....;.....;o....;....;<....;.....;.....;l....;....;/....;.....;[....;Q....;.....;j....;.....;.....;L'...;.E...;lZ...;.o...;.q...;.r...;.s...;.{...;.{...;.~...;"....;.....;U....;.....;.....;.....;....;d....;.....;.....;i....;.....;f....;....;0....;.....;.....;.(...;+...;.+...;A....;54...;.9...;,O...;.`...;.n...;.~...;.....;.....;M....;....;;....;q....;Z....;.....;.....;.-...;\=...;.P...;.d...;@\|...;.....;Y....;#....;_....;/....;.....;.#...;.;...;.J...;gc...;cf...;W....;....;W....;.....;.....;.....;7....;.-...;.I...;Y\...;W....;....;.....;S....;.....;t....;.....;.....<W....<.&...<9<...<iG...<jQ...<.X...</a...<gi...<.n...<Pz...<.....<f....<.....<I....<.....<.....<.....<4C...<4d...<....<....<.....<.....<.....<D8...<.e...<_....<....<.... <I...!<...."<.E..#<.E..)<.G..<%j..+<N...,<....;<....<<v...=<....><....?<....@<y...A<....B<....C<....D<....E<"F..F<.J..G<.O..J<.X..K<.e..L<.r

C:\Users\user\AppData\Roaming\GamePall\chrome_elf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1174528
Entropy (8bit):	6.475826085865088
Encrypted:	false
SSDEEP:
MD5:	207AC4BE98A6A5A72BE027E0A9904462
SHA1:	D58D2C70EA0656D81C627D424F8F4EFCCEF57C86
SHA-256:	2BA904DA93ACC4766639E7018AC93CC32AA685DB475F3A59B464C6BC8B981457
SHA-512:	BFB6C58774829DB3D5FADC92CB51477FF4EAC8FB934DB6583A312BB1157468F6DD3A4A3AFAF25A687B74890DC8A69857A12D0B38B18D83E82836E92E02046FF3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....v...p......P.....................................................@A........................vT......AX..<.......x...........................<<.......................;......(...............<[.......O.......................text....u.......v.................. ..`.rdata..\............z..............@..@.data...H...........................@....00cfg...............F..............@..@.crthunk.............H..............@..@.tls.................J..............@...CPADinfo(............L..............@...malloc_h.............N.............. ..`.rsrc...x............P..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_43.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2106216
Entropy (8bit):	6.4563314852745375
Encrypted:	false
SSDEEP:
MD5:	1C9B45E87528B8BB8CFA884EA0099A85
SHA1:	98BE17E1D324790A5B206E1EA1CC4E64FBE21240
SHA-256:	2F23182EC6F4889397AC4BF03D62536136C5BDBA825C7D2C4EF08C827F3A8A1C
SHA-512:	B76D780810E8617B80331B4AD56E9C753652AF2E55B66795F7A7D67D6AFCEC5EF00D120D9B2C64126309076D8169239A721AE8B34784B639B3A3E2BF50D6EE34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h...;...;...;..];...;...;...;.._;...;..h;0..;..i;'..;..X;...;..l;D..;?M.;...;..Y;...;..^;...;Rich...;........PE..L...92.K...........!.........d...............................................p .....O. ...@.........................@.......@...P..................... .h............................................i..@............................................text...S........................... ..`.data....~.......B..................@....rsrc................(..............@..@.reloc..D............,..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4127200
Entropy (8bit):	6.577665867424953
Encrypted:	false
SSDEEP:
MD5:	3B4647BCB9FEB591C2C05D1A606ED988
SHA1:	B42C59F96FB069FD49009DFD94550A7764E6C97C
SHA-256:	35773C397036B368C1E75D4E0D62C36D98139EBE74E42C1FF7BE71C6B5A19FD7
SHA-512:	00CD443B36F53985212AC43B44F56C18BF70E25119BBF9C59D05E2358FF45254B957F1EC63FC70FB57B1726FD8F76CCFAD8103C67454B817A4F183F9122E3F50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!7P.OdP.OdP.Od..NeR.OdP.Nd..OdY..dU.Od.Jem.Od.KeQ.Od...dQ.Od..Leo.Od..Je..Od..OeQ.Od..Ge..Od..Kec.Od...dQ.Od..MeQ.OdRichP.Od................PE..L..................!.....2<..*...............P<...............................?.......?...@A.........................<<.u.....=.P.....=.@.............>..%....=.........T....................u..........@.............=..............................text...e0<......2<................. ..`.data...`"...P<......6<.............@....idata........=.......<.............@..@.rsrc...@.....=.......<.............@..@.reloc........=.......<.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\devtools_resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	2205743
Entropy (8bit):	7.923318114432295
Encrypted:	false
SSDEEP:
MD5:	54D4E14BFF05C268248CAB2EEDFB61DD
SHA1:	33AF472176F6E5FB821FFE23C9FBCCC7C735B5B9
SHA-256:	2CAC401BFFA9FD4DFFE11E05EE18FC5CA7A30EC5BF7EF6A3EA8518A4F3344790
SHA-512:	5A6893E7EA30EAA0EFF44687B0D15366A8224E476E4AE8FE0D5C7EF2B3C62E6B0184F73EAD36C4E4E08D6936524CEF8429660B3EC29453EED128E3C5368CE78C
Malicious:	false
Reputation:	unknown
Preview:	........K....[.....[.....[.....[Y....[.....[.....[.....[.....[P ...[.!...[."...[.#...[.$...[.%...[.%...[T&...[0'...[/(...[.(...[.(...[....[.+...[{,...[1-...[.-...[3....[b/...[.0...[.1...[.2...[.3...[,4...[.4...[P5...[.5...[#6...[!8...[.8...[.9...[.9...[::...[q;...[Y=...[.=...[ ?...[.@...[0A...[iB...[?D...[.E...[pE...[UF...[.G...[.H...[)I...[.I...[.M...[.M...[DN...[.N...[FO...[.O...[.Q...[oV...[uW...[cX...[[\...[.]...[Ea...[bc...[.c...[ d...[.d...[oe...[.f...[.h...[.i...[Xj...[.k...[.l...[An...[.o...[.p...[.....[....[.....[.....[.....[.....[[!...[.%...[d....[x1...[.4...[.4...[.9...[.C...[.Q...[KS...[#V...[=]...\.b...\.z...\Q}...\.....\.....\....\`....\.^...\7b...\uy...\g....\.....\.....\=....\....\....\....\'....\.....\....\.... \....!\...."\....$\....%\....&\....)\....\....+\.Q..,\.S..-\.U...\..../\w...0\....1\8...2\....3\....4\....5\....6\....7\.T..8\.z..9\6...:\....;\c...<\)&..=\...>\>5..?\JU..@\.r..A\....B\9...C\....D\S...E\....F\\y..G\Y...H\%...I\....J\M...K\.a..L\.j..M\.n

C:\Users\user\AppData\Roaming\GamePall\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	10717392
Entropy (8bit):	6.282534560973548
Encrypted:	false
SSDEEP:
MD5:	E0F1AD85C0933ECCE2E003A2C59AE726
SHA1:	A8539FC5A233558EDFA264A34F7AF6187C3F0D4F
SHA-256:	F5170AA2B388D23BEBF98784DD488A9BCB741470384A6A9A8D7A2638D768DEFB
SHA-512:	714ED5AE44DFA4812081B8DE42401197C235A4FA05206597F4C7B4170DD37E8360CC75D176399B735C9AEC200F5B7D5C81C07B9AB58CBCA8DC08861C6814FB28
Malicious:	false
Reputation:	unknown
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html ......E.......E.......E..P/...E.../...E..P7...E...7...E...h...F...h.. F..Pi..0F......DF.....WF.....jF..P...}F.......F..`....F.......F.. ....F.......F..0....F.......G......G......(G.....;G..@...NG......aG.....tG.......G.......G..@....G.......G.......G.......G..P....G.......H.......H..P...2H......EH..`...UH......hH......yH..P....H.......H.......H..`....H.......H.......H..P....I.......I......-I..@...=I......PI......aI..@...uI.......I...0...I.. 1...I..p1...I...e...I...e...I...i...I..`i...J...i..)J...K..BJ..p...^J..."'.uJ..P.'..J....'..J...5'..J..06'..J...>'..J..P?'..K...D'..K...F'.0K...H'.IK...V'.hK....(..K....(..K..P.)..K....)..K..pW..K..P...L...*+.?L..p.+.bL....+..L...U,..L....,..L....,..L....,..L..@.,..M....,.-M..P.-.IM.. e-.`M...e-.~M...R/..M.../..M..0.0..M..@.0..M..P.0..M....0..N....0.!N...,0.9N...,0.NN..0-0.fN...-0.vN...Y0..N...Z0..N..

C:\Users\user\AppData\Roaming\GamePall\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	377856
Entropy (8bit):	6.602916265542373
Encrypted:	false
SSDEEP:
MD5:	8BC03B20348D4FEBE6AEDAA32AFBBF47
SHA1:	B1843C83808D9C8FBA32181CD3A033C66648C685
SHA-256:	CBEE7AC19C7DCCCA15581BD5C6AD037A35820DDFE7C64E50792292F3F2E391E6
SHA-512:	3F9EEC2C75D2A2684C5B278A47FB0E78B57F4F11591FAC4F61DE929F716BBAA8F7DF05E10390408AD6628538611541548C26869822372E9C38D2C9C43881651E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....`...`............................................... ............@A........................8,..h....:..(.......x........................>..........................D........p..............(<..`............................text....^.......`.................. ..`.rdata..L....p.......d..............@..@.data....4...p.......`..............@....00cfg...............\|..............@..@.tls.................~..............@....rsrc...x...........................@..@.reloc...>.......>..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6635008
Entropy (8bit):	6.832077162910607
Encrypted:	false
SSDEEP:
MD5:	63988D35D7AB96823B5403BE3C110F7F
SHA1:	8CC4D3F4D2F1A2285535706961A26D02595AF55C
SHA-256:	E03606B05EEAED4D567EA0412350721C0D566B3096B18C23BD0B3FCDE239E45A
SHA-512:	D5F5ACA00BE9E875FCD61531CC7F04F520FB12999E36E4FE06BEAAE491B47D2E9FE182015DB1CBFBB8E78CF679F2EB49E20ECDF1B16D1D42058D6F2D91BC3359
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!......L...........@.......................................e...........@A.........................].......^.d.....a.......................a.."...U]......................T].....X.L.............H.^.@.....].@....................text.....L.......L................. ..`.rdata...I....L..J....L.............@..@.data...X....._.......^.............@....00cfg........a.......a.............@..@.tls..........a.......a.............@....rsrc.........a.......a.............@..@.reloc..."....a..$....a.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176517632
Entropy (8bit):	7.025874989859836
Encrypted:	false
SSDEEP:
MD5:	F5259CC7721CA2BCC8AC97B76B1D3C7A
SHA1:	C2FC0C8396D8CD6764809A2A592972E2EBCA64BA
SHA-256:	3FE6A262EF01CB8FD4DC2D4373DE0F1F0A89EE51953452ED4557CB55F1DA9AB4
SHA-512:	2D01B1F2B24717EFF37965BBC32D167434A65F3DFFF74342D2E2FA8FBB0E97C3F61FDF673A13AD63031D630D9CE46A6F9F0C4F89EBD30C31F3EA55817B9D1331
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.........N.......k....................................................@A........................#..........h....0J.(C....................L.\|.\.P................................?..............`.......LY..@....................text............................... ..`.rdata...%2..0...&2.................@..@.data...dr+..`.......>..............@....00cfg........I.......&.............@..@.rodata.@.....I.......&............. ..`.tls..........J.......&.............@...CPADinfo(.....J.......&.............@...malloc_h..... J.......&............. ..`.rsrc...(C...0J..D....&.............@..@.reloc..\|.\...L..0\..B).............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\libcef.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40258
Entropy (8bit):	4.547436244061504
Encrypted:	false
SSDEEP:
MD5:	310744A0E10BD9C2C6F50C525E4447F9
SHA1:	9BA62D6AC2CB8EFF46C9B21051677FC1DC66D718
SHA-256:	E9C55CFF925E26812139CDCAD6612E0D69E317CB7BB1435C9EB5113D338ACCE7
SHA-512:	6DF9E3F9AFD7CDEC750B006987E5AEC445E163DD0B9CF1A9EA53F78DB2EE5FD654E3B4F82BCA3E1F4BEDB189F5DFA51189C820905676AD048DBE2E0AD405BF5B
Malicious:	false
Reputation:	unknown
Preview:	!<arch>./ 0 0 0 0 14390 `.......8z..:&..:...;...;...<&..<&..<...<...=...=...=...=...>...>...>...>...>...>...?f..?f..?...?...@B..@B..@...@...A$..A$..A...A...B"..B"..B...B...C...C...C...C...D...D...D...D...D...D...E...E...E...E...Fn..Fn..F...F...GZ..GZ..G...G...HJ..HJ..H...H...I$..I$..I...I...J...J...J...J...K ..K ..K...K...L...L...L...L...M...M...M...M...N...N...N\|..N\|..N...N...Od..Od..O...O...P`..P`..P...P...QP..QP..Q...Q...RT..RT..R...R...S@..S@..S...S...T...T...T...T...U...U...Un..Un..U...U...VP..VP..V...V...W,..W,..W...W...X...X...X...X...X...X...Y\..Y\..Y...Y...ZB..ZB..Z...Z...[,..[,..[...[...\...\...\...\...\...\...]b..]b..]...]...^N..^N..^...^..._6.._6.._..._...`$..`$..`...`...a...a...a...a...b...b...b...b...c...c...c...c...c...c...dj..dj..d...d...e^..e^..e...e...fV..fV..f...f...g8..g8..g...g...h..h..h...h...i"..i"..i...i...j...j...j...j...k...k...k...k...l...l...l...l...l...l...mh..mh..m...m...nN..nN..n...n...o2..o2..o...o...p...p...p.

C:\Users\user\AppData\Roaming\GamePall\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	470498
Entropy (8bit):	5.409080468053459
Encrypted:	false
SSDEEP:
MD5:	64F46DC20A140F2FA3D4677E7CD85DD1
SHA1:	5A4102E3E34C1360F833507A48E61DFD31707377
SHA-256:	BA5CA0A98E873799A20FD0DF39FDB55AAB140E3CC6021E0B597C04CCE534246D
SHA-512:	F7D789427316595764C99B00AF0EF1861204F74B33F9FAB0450F670CB56290C92BFB06EF7D1D3B3BF0B6ACDC6295E77F842C49579BD9973E3D5805920CDB2527
Malicious:	false
Reputation:	unknown
Preview:	........$$..e.>...h.F...i.N...j.Z...k.i...l.t...n.\|...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................&...........5.....<.....C.....D.....E.....J.....W.....f.....w.................x.................A.......................S.........................................%.....{.......................V.......................J.......................Y.......................e.......................a.......................l...................................O.....f.......................).....z.......................6.....u.......................Q.......................E.....w.................!.....I.....R.............................l.......................f.................+.............................f.......................D.......................<......................._.......................2.....~.................2.....v.................X...........$.....8.................P.....r...........6.....j.....}.................1.....?...................

C:\Users\user\AppData\Roaming\GamePall\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	763010
Entropy (8bit):	4.909167677028143
Encrypted:	false
SSDEEP:
MD5:	3B0D0F3EC195A0796A6E2FAB0C282BFB
SHA1:	6FCFCD102DE06A0095584A0186BD307AA49E49BD
SHA-256:	F9F620F599BC00E84A9826948C3DA985AC9ADB7A6FFB4C6E4FBEFEAF6A94CF85
SHA-512:	CA9217F22C52EF44E4F25142D1AD5DD9D16E4CCC3B6641609E1F4C2650944E35BA4CAB59CA5CD9EA6FEFD6BE1D3E8227FC0E3E6BDEDD14B059CA2C72D096D836
Malicious:	false
Reputation:	unknown
Preview:	........>${.e.r...h.z...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.(...\|.....}.@.....H.....M.....U.....].....e.....l.....s.....z.....{.....\|...............................................F.....f.....'...........V...........Y.............................5.................F.................!.................d.....z...............................................C...........\.................z...........h...........3...........$.....C.................e.................i.................,.......................X.............................h.......................!.....\|...........$.............................1.....}.........................................Z.................\|...........'.....N...........F.................;.............................G.................v............ ....4 ..... ....X!.....!.....!....x"....."....Z#.....#....M$.....%.....%.....%.....&....+'.....'.....'.....(....D).....).....)....2....................+....",.....,

C:\Users\user\AppData\Roaming\GamePall\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	838413
Entropy (8bit):	4.920788245468804
Encrypted:	false
SSDEEP:
MD5:	C70B71B05A8CA5B8243C951B96D67453
SHA1:	DEED73A89F0B3EDAB8FF74117CC6B31CB4F426E8
SHA-256:	5E0D4BC0893A334B6FFF610F66E4A00920530D73EC3257EB9D37A96EBD555C13
SHA-512:	E000FD3592AC5FE700C4CE117868915C066AC66D5954A1DE4F5AFF0F4559C93F7DFF47623F1837CE827FFF94E91ECD89A974037BE9CCCC8E672E229A1E8115E9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.!...n.)...o.....p.;...q.A...r.M...s.^...t.g...v.\|...w.....y.....z.....\|.....}.........................................................................-.....d.................n...........A...........u.......................O.......................D.................Y...........3.....J...........=.....g.....~.....&.................O.......................B.....!...........u...........5...........).....W.................3.....N.....U.....B...........!.........../.....Y........... .......................g...........).....I.................#.....A...........@.................6........... .....D...........I.................%.............................=.................?...................................G...................................).....t............ ..... ..... ..... ....o!.....!....6"....\"....."....S#.....#.....#.....$.....%....V&.....&....5'.....'.....(....J(.....(....X).....).....).........z..............t+.....,....{,.....,....--

C:\Users\user\AppData\Roaming\GamePall\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	869469
Entropy (8bit):	4.677916300869337
Encrypted:	false
SSDEEP:
MD5:	12A9400F521EC1D3975257B2061F5790
SHA1:	100EA691E0C53B240C72EAEC15C84A686E808067
SHA-256:	B7FD85B33B69D7B50F6C3FDC4D48070E8D853C255F2711EEDAA40D1BA835F993
SHA-512:	31EAA1CBF13BC711750B257C6B75813ACC8E4E04E9262815E399A88B96BA7B5BE64CE2450638B5521D5CB36750C64848944168C3234D2CE15A7E3E844A1E1667
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....L.....n...................................I...........Q...........q.......................T.................E.......................7.....~...........<.................:.....&...........F.................X...........$.................Z...........X...........m.................C.........................................{...........:.....a...................................8................._...........O.....}...................................$.....h.........................................2.............................3 ....e .....!.....!.....!.....".....".....#....W#.....#....{$....-%.....%.....%.....&....k'.....'....T(.....).....).....).....).....*....`+.....+.....+.....,....p-.....-....&....../...../.....0.....0.....1....o2.....2....73.....4.....4.....4....-5.....5....X6.....6.....6.....7.....8.....9

C:\Users\user\AppData\Roaming\GamePall\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1118348
Entropy (8bit):	4.2989199535081895
Encrypted:	false
SSDEEP:
MD5:	89A24AF99D5592AB8964B701F13E1706
SHA1:	2177122C6DCC20E1D07EF43AF5A112E8E5C6B95B
SHA-256:	5BDBBCD0D07B6AE3A7F96F07871EE541F4111D90D73FD6E112C5ABE040025C96
SHA-512:	60F6CD73BF35886EF54FA6200F86BCED78DD11F612C8071F63EB31108F109C166D45609879E8E5107024A025BAFCFCF1C80051B6D8FF650D92DCF17136384EB1
Malicious:	false
Reputation:	unknown
Preview:	........($..e.F...h.N...i._...j.k...k.z...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......#.....(.....0.....8.....=.....E.....L.....S.....Z.....[.....\.....a.............................=.....G...........?.....4...........................................................B.....}.....>...........k...........X...........].............................q.....W...................................W...........S...........e.............................I.....m.....e..........._.....(.................9...........q.................p...........5.....X.....8...........Q...........M...........I.....u.....-...........!.....G............ ..... ..... .....!....P".....".....".....#.....%.....%.....&.....'.....'....^(.....(....;).....).........6.....+.....+....1,....],....E-................-/...../....x0.....0.....0.....1.....2.....2.....3...."4.....4....x5.....5.....6....78....*9....]9.....:.....;....;<.....<.....=....?>.....>.....>.....?....y@.....@.... A....&B.....B

C:\Users\user\AppData\Roaming\GamePall\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537139
Entropy (8bit):	5.397688491907634
Encrypted:	false
SSDEEP:
MD5:	37B54705BD9620E69E7E9305CDFAC7AB
SHA1:	D9059289D5A4CAB287F1F877470605ED6BBDA2C8
SHA-256:	98B2B599C57675EFC1456B38B23CE5657B142E0547F89AB1530870652C8EB4BA
SHA-512:	42D667FEB59BB5FA619AC43DC94629ED1157CBE602643FB21378A2C524EF1F6E32098E7C62D3F3DE35D9FEDEF6607FE034908601AE3C49156CD0916E2514D2F9
Malicious:	false
Reputation:	unknown
Preview:	........%$..e.@...h.H...i.P...j.\...k.k...l.v...n.~...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}................... .....(.....0.....7.....>.....E.....F.....G.....I.....c.....\|................._...........[.....z...........O.................D...........(.....G.................B....._.................A.....T.................8.....I...........3.....u...........(.......................p.................,.......................1.................T.....o.............................v.......................b.......................@.......................@.......................O.......................<.............................`.......................P.........................................M.......................H......................._.........................................n.......................Q.......................[.............................1.................>.........................................6.............................\|...........".....>.

C:\Users\user\AppData\Roaming\GamePall\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	545011
Entropy (8bit):	5.844949195905198
Encrypted:	false
SSDEEP:
MD5:	65A2C2A73232AB1073E44E0FB6310A5F
SHA1:	F3158AA527538819C93F57E2C778198A94416C98
SHA-256:	E9A1610AFFCA9F69CD651C8D2EDD71B5A0F82CB3910A8A9D783F68E701DB5BB0
SHA-512:	20ED527F3BBBA2CECE03D7B251B19D6DCC9D345B5425291D8139FCDD5646EC34D585891160CC4BD96C668D18FFFFDD56F4D159880CFC0D538749F429F7F65512
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.&...i.....j.:...k.I...l.T...n.\...o.a...p.n...q.t...r.....s.....t.....v.....w.....y.....z.....\|.....}.................................................#.....$.....%.....'.....7.....I.....[.....p.............................\|.................%...........(.........................................3......................./.......................2.......................z...........I.....k...........R.......................v................./.......................z...........=.....W.................&.....=....................... .....o.......................^.......................r.......................m.......................b.......................z.................0...........%.....i.......................3.....G.......................(.......................1.................R................./.....J.....^...........A.....q.................`.................,...................................V.....w...........Z.......................O.....t.................b.......

C:\Users\user\AppData\Roaming\GamePall\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	496165
Entropy (8bit):	5.446061543230436
Encrypted:	false
SSDEEP:
MD5:	A44EC6AAA456A6129FD820CA75E968BE
SHA1:	9B5B17AFD57ADB8513D2DA9A72223E8A003975A5
SHA-256:	F01F9C3E4E6204425F2969F77BF6241D1111CE86CDD169BDF27E5D2D4B86C91A
SHA-512:	947DB81EA64009CC301CD2DCE06384202E56446F6D75E62390334B91D09B564CB0681E06BF7A945033BD6C28C2171346A91EE16693262C4E373A31B51AD42A9E
Malicious:	false
Reputation:	unknown
Preview:	........,$..e.N...h.V...i.g...j.s...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}."........../.....7.....?.....G.....N.....U.....\.....].....^.....`.....n.....~.........................................Q..................................q.................].......................P.....w.................8.....b.....p...........9.....h.................n.................7.......................^............................. .....p...................................q.......................X.......................1...............................................".............................{.......................Z.......................C.....p.....~...........y.................4.............................l.......................I.....f.....v...........^.................................................................F.......................B...................................O.....~...........J.....z.................$.....@.....M.................F.

C:\Users\user\AppData\Roaming\GamePall\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	534726
Entropy (8bit):	5.49306456316532
Encrypted:	false
SSDEEP:
MD5:	49CA708EBB7A4913C36F7461F094886B
SHA1:	13A6B5E8DC8B4DF7A976A0859684DC0AA70F1B12
SHA-256:	8AE7D6B77C51A4FE67459860ABDAE463F10766FAF2BA54F2BB85FD9E859D2324
SHA-512:	6908F96BFDF7499B33E76697AA96103E89ACB3E25EDBD6156B610564AF14D4ED474C547A760503490B6327A801478E223039836BEEF2B938AF76827A15C0F751
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.~...h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.%...y.+...z.:...\|.@...}.R.....Z....._.....g.....o.....w.....~.................................................................X.................E...................................^.....x...........n................./.......................Z...................................U.....w.............................h...........&.....7...........9.....w........... ................. ..........._.................D.......................U.......................h...................................a.....x...........f.........................................F.......................u...........).....;...........j.................A.......................;.......................9.......................t...........,.....`...........-.....K.....b...........G.....s.................}.................T...........,.....6...........S................./.......................K.......................t...........*.

C:\Users\user\AppData\Roaming\GamePall\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	950999
Entropy (8bit):	4.76377388695373
Encrypted:	false
SSDEEP:
MD5:	9CBC320E39CFF7C29F61BD367C0BF3BB
SHA1:	2AF07EFFF54A0CF916CF1C0A657F7B7ADF2029FF
SHA-256:	E8837DEFA908EB2FD8B4EB6344412C93403A4258F75EC63A69547EB06A8E53B3
SHA-512:	F7D84185F4520E7AAF3F3CACF38B53E9638BB7D5023FA244020EC8D141FFD5C10B198FF089824D69671FE8350F931B0BB19B6CAF14AF47B0838953367A146DD0
Malicious:	false
Reputation:	unknown
Preview:	........)$..e.H...h.P...i.X...j.b...k.q...l.\|...n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...................&...........6.....=.....D.....K.....L.....M.....O.....v.......................5...................................V.................h...........F.....i...........~...........{...........a...........'.................&.......................M.....U.....O............................./.....J.....1..........._...........{.....6................. .............................g.......................<.................J...........8.....t.....O.....).......................U............................................................ ..... .....!.....!.....".....#.....$.....$.....$.....%....\|&.....&.....'.....'....;(....t(.....(....M).....)....;....h....U+.....,.....,.....,.....-....8.....t...........f/....(0.....0.....0.....1....S2.....2.....3....64....Q5.....6....@6....A7....(8.....8.....8.....9.....:....o;.....;....[<....%=.....=.....=.....>.....?....6@

C:\Users\user\AppData\Roaming\GamePall\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	430665
Entropy (8bit):	5.517246002357965
Encrypted:	false
SSDEEP:
MD5:	0F1E2BC597771A8DB11D1D3AC59B84F3
SHA1:	C1F782C550AC733852C6BED9AD62AB79FC004049
SHA-256:	E4798E5FF84069C3BFD7D64734CCD9FF5C8A606315B44A714ACDCABDDAF3CA6E
SHA-512:	07E9B98357C880995576059AD4E91E0F145DC0F2FFF2DFDAD8649FA42EB46FA86F7F093503C41019EAD4550784E26C553D171518355FBBF995E38B1F6D7ABFF0
Malicious:	false
Reputation:	unknown
Preview:	.........$ .e.(...h.0...i.>...j.J...k.Y...l.d...n.l...o.q...p.~...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.....................................%.....,.....3.....4.....5.....:.....G.....V.....f.....w...........J.......................H.....y.................I.......................@.....o.......................?.....M............................._.......................B.......................8.............................[............................V.....a................l............................. .....^.............................A.....b.....n.................H.....[.......................+.....t.......................5.....y.......................:.....c.....n...........'.....d.....y.................).....?.............................G.............................].......................4.....O.....^.................6.....F.................#.....;.................V.....d...........$.....[.....x.................F.....U.............................k.............

C:\Users\user\AppData\Roaming\GamePall\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	434598
Entropy (8bit):	5.509004494756697
Encrypted:	false
SSDEEP:
MD5:	FEAB603B4C7520CCFA84D48B243B1EC0
SHA1:	E04138F1C2928D8EECE6037025B4DA2995F13CB4
SHA-256:	C5B8FBDBB26F390A921DCACC546715F5CC5021CD7C132FD77D8A1562758F21F4
SHA-512:	E6B3970A46D87BFD59E23743B624DA8116D0E1A9912D014557C38FD2664F513E56317AFA536DF52E7E703863FBD92136BE57EE759A2FFC2958AB028F6287E8B7
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.,...y.2...z.A...\|.G...}.Y.....a.....f.....n.....v.....~.................................................................G.......................\.......................Q.......................T......................./.....t.......................7.....^.....k.................".....9.................!.....9.............................i.......................7.......................!.............................K.....f.....u.............................Y.............................k.......................G.....t.......................7.....B.............................J.......................$.....~.......................^.............................=.....R.............................q.......................X.............................X.......................7.....o.................X.......................k.......................a.......................!.....C.....S.................,.

C:\Users\user\AppData\Roaming\GamePall\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	524728
Entropy (8bit):	5.377464936206393
Encrypted:	false
SSDEEP:
MD5:	32A59B6D9C8CA99FBD77CAA2F586509A
SHA1:	7E8356D940D4D4CC2E673460483656915AA59893
SHA-256:	AA4A5AA83DD5F8476867005844F54664DB1F5464A855EF47EC3A821DAF08E8F2
SHA-512:	860BA06228BBA31EEC7EB8BD437DDB6E93BABD0129033FB6EFF168F2FB01B54E2B93D2AB50A5D4F5D2FB7B04A5D0DD5541999D708CC2613B74AADD17B3E98735
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....j.....\|.......................J...........>.....Y...........1.....v..........."...................................L.....g.................4.....G.................,.....=...........7.....}...........6...................................6.....I.................\.....s..........._.................Z...........2.....Y.......................:.......................".......................0.................R.....e...........).....g.....s.................P.....[.................4.....>.................L.....\...........O.................!.....v.................+.....x.................i.................:.................2.......................!.......................0.................I.....c...........x.............................B.....p...........V.......................G.....j.....}...........n.............

C:\Users\user\AppData\Roaming\GamePall\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	523181
Entropy (8bit):	5.356449408331279
Encrypted:	false
SSDEEP:
MD5:	3D1720FE1D801D54420438A54CBE1547
SHA1:	8B1B0735AE0E473858C59C54111697609831D65A
SHA-256:	AE32D66C0329104B9624BA0811FE79149D1680D28299440EC85835DBA41C7BD2
SHA-512:	C033BBB5261EC114DCB076EDB5E4B3293F37D60C813674A947F996606A6289204C04D2E4315356D92EEEB43FF41D534997DBEBBF960B17F2F24AA731AFE4B7E1
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.p...j.\|...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.+.....3.....8.....@.....H.....P.....W.....^.....e.....f.....g.....i.....\|.......................O...........G.....b...........D.................0........... .....:.................Y.....t.........../.....^.....n...........0.....X.....i...........c.................W...................................I.....Z................f.....{...........o.................g...........+.....P.................8.....N.................".....1......................@.................?.....R.................;.....G.................%.....0.............................y...................................D.....^.................@.....].................5.....T...........;.....`.....s...........h.................M.......................A.......................W.............................&.................)...................................A.....U................. .....3.................D.

C:\Users\user\AppData\Roaming\GamePall\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	475733
Entropy (8bit):	5.456553040437113
Encrypted:	false
SSDEEP:
MD5:	C00D66D3FD4FD9D777949E2F115F11FB
SHA1:	A8EAAD96CABCDFB7987AF56CB53FA5E16143EC48
SHA-256:	26C438935E3F666329EE8D1DABA66B39179BCF26EBAC902F9B957A784BDC9B4A
SHA-512:	E7E8C083B556DD05874AC669B58A4D1CD05D1E1B771EB4C32942869E387C6FA2B317B5F489138BD90135117DAEB051D96A7823B531DF0303BD4245A036F25A20
Malicious:	false
Reputation:	unknown
Preview:	........@$y.e.v...h.~...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.#...z.2...\|.8...}.J.....R.....W....._.....g.....o.....v.....}.....................................................S...........J.....e...........4.....d.....w...........Y.......................u.......................m.......................\.......................[.........................................7.......................;.......................K.......................x...........;.....R.................9.....T................. .....,.............................w...........#......................./.....=.................'...../.................".....1.................$.....,.................O.....g.................4.....J.................,.....O.................4.....A.................=.....i.................&.....7.................#.....;.................?.....Z...........U.................C...................................@.....M...........................................

C:\Users\user\AppData\Roaming\GamePall\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	773397
Entropy (8bit):	5.04618630633187
Encrypted:	false
SSDEEP:
MD5:	C998140F7970B81117B073A87430A748
SHA1:	8A6662C3AABDAC68083A4D00862205689008110C
SHA-256:	182F18E4EFCA13CA59AFD1DF2A49B09733449D42526EE4700B11A9C5E6AAC357
SHA-512:	5A947A44F674F9556FDD44D2E4FF8CF0E0AAC4475FFA12480CA1BD07CFE7514961B7CACE6760189432B4B4BEB5EA5816701158EB3CB827A806F3063853C46D5E
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.#...s.4...t.=...v.R...w._...y.e...z.t...\|.z...}...............................................................................-.....T.....9.......................^...........u..........._.............................H.................a...........S.....f...................................?.................j..........._.............................'...........f.......................I.......................v.............................Q.....u...........}.................S...........).....@...........x.................m...........M.....d...........p.................H.................:...........`.................`...........l...............................................s...........C...........0.....P.......................;...........1 ....V ....q ....+!.....!....'"....I"....."....\|#.....#.....#.....$.....%.....&.....&....j'.....(....l(.....(....W).....)....M....p.....*....n+.....+.....+....d,.....-....P-....x-

C:\Users\user\AppData\Roaming\GamePall\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	483378
Entropy (8bit):	5.428549632880935
Encrypted:	false
SSDEEP:
MD5:	1CFD31A6B740D95E4D5D53432743EBF1
SHA1:	20CEEEA204150BD2F7AAE5866C09A3B0AE72D4C5
SHA-256:	F821E06B4BACD9E7660A2D6912A049591FFD56C6D2A0A29B914648589B17B615
SHA-512:	C483B7347F91BE8EE515DCF352A1D7502B9A159EDE35EACCEBAA763B93A625BCE2D0C7D598C2A6111092257D6DAC7A167102E956697210D4694B9812D70C8A94
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.%...v.:...w.G...y.M...z.\...\|.b...}.t.....\|.....................................................................................................^.....q...........7.....j.....}...........Z.......................~.......................s.......................D.....d.....t........... .....F.....`...........C.......................Q.....}.................S.......................T.........................................E.............................k......................./.....P.....\.................).....3.............................p.......................L.......................0.......................%.......................B.............................g.......................e.......................d.......................M.....d.....s...........*.....T.....f...........".....[.....u...........x.................I.......................Y.......................4.....v.......................S.....~.

C:\Users\user\AppData\Roaming\GamePall\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	546749
Entropy (8bit):	5.197094281578282
Encrypted:	false
SSDEEP:
MD5:	6EDA0CD3C7D513AAB9856EC504C7D16F
SHA1:	BA24C4B994E7866F2C012CCEC6C22DFC1A4FCFF6
SHA-256:	3CD2BC9E887663C5E093E0334BC60CF684655A815E3DE7AD9A34BAD5EBB858B1
SHA-512:	47000F5EA882CB9EDDCF4FB42ED229423EE55AA18B4A4353D7EF85ADFA7E1B0BBB33C2469887224D7146B3E33FB2296749CD053D68D7DAF26980BC710A27C63E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.@...h.H...i.^...j.j...k.y...l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.......!.....&...........6.....>.....E.....L.....S.....T.....U.....Z.....g.....\|.................K...........:.....X...........O.................Q...........>.....e...........Z.......................~.................%.......................h.................H...........^.................M.................!.................H.....b...........].................V...........B.....d...........#.....N.....k.................A.....N.................,.....;.................S.....i...........5.....k.....z...........=.....o.....}...........>.....o.....}...........@.....r...................................R.......................L.......................<.......................e.................U.................F.....`...........>.....q.........................................%.................4.................4.................J.....b.................B.....X...........N.......

C:\Users\user\AppData\Roaming\GamePall\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	568277
Entropy (8bit):	5.380723339968972
Encrypted:	false
SSDEEP:
MD5:	D185162DF4CAC9DCE7D70926099D1CF1
SHA1:	46594ADB3FC06A090675CA48FFA943E299874BBD
SHA-256:	E40C07183A32B75930242F166C5AAE28F4CD769BB2268391BEAA241814E7D45A
SHA-512:	987D9CC6AD5F2ED6A87537FDADF105F6EB31A97B11156E70814FE021047E5D8D08398F008812038DF3CCDCB6254BF5B744D9982FE04F79D407AC2F53BB046E25
Malicious:	false
Reputation:	unknown
Preview:	.........$..e. ...h.(...i.9...j.E...k.T...l._...n.g...o.l...p.y...q.....r.....s.....t.....v.....w.....y.....z.....\|.....}..................................... .....'.........../.....0.....2.....B.....P.....b.....q.................6.....X...........?.................'.................(.................W.................4.....`.....p...........D.........................................{...........(.....L...........*.....i.....{...........S.........................................}...........i.................N.......................H.....r.................N.......................f.......................}.......................x.......................e.......................d.................+.................&.......................8.....~.......................k.................0...........;.......................f.........................................d.................6...........4................."...................................R.....k.................G.....[...........G.......

C:\Users\user\AppData\Roaming\GamePall\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1103776
Entropy (8bit):	4.336526106451521
Encrypted:	false
SSDEEP:
MD5:	44F704DB17F0203FA5195DC4572C946C
SHA1:	205CBCC20ADCCCF40E80AA53272FBA8CD07389CA
SHA-256:	4B073F08F0C8C035974B5EC43AA500F8BDD50E6CFE91A2FB972A39E0F15ECEDD
SHA-512:	3CFD4501556845141EE9B461C831CA59779AD99F0E83E8D03433DE78D774378E87DE752DD9711C112A0C584259AD1DA6DC891D92F3F447F63A4D84263CD5BFCE
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.#...\|.)...}.;.....C.....H.....P.....X.....`.....g.....n.....u.....v.....w.....\|.......................&.....b....._.....0.....l....._..... ...............................................a.......................G.................r...........\.....\|....._...........z.......................V...........n.....B...................................7.....4...../.......................".......................4.....p...........P...........E.....m.......................................................................'...........}.......................C.................j .....!....u!.....!.....".....#....\$.....$....K%.....%....R&....{&.....'.....'.....'.....'.....(....b).....).....*....'+.....+....t,.....,.....-....9.....\|............/....W0.....0.....0.....1.....2....33....f3.....4.....5.....6.....6.....7.....8....<9.....9....\|:....H;.....;.....;.....<....s=.....=.....=.....?.....?.....@

C:\Users\user\AppData\Roaming\GamePall\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	681555
Entropy (8bit):	4.658620623200349
Encrypted:	false
SSDEEP:
MD5:	E75086A24ECAA25CD18D547AB041C65A
SHA1:	C88CE46E6321E4A21032308DFD72C272FB267DBD
SHA-256:	55BE8A5ED9FB9C129AC45B7FC99574B9907350AFD024BAA5D07525F43E995F6B
SHA-512:	01D7FDD90B8D0D3779B8442250E2AA767481B2E581F880BF9C3DCBB15FCE52E477B1881F3704FBCB3172DB77DB10241BCB24851BFE30066D1E9B66244B3C6877
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.'...k.6...l.A...n.I...o.N...p.[...q.a...r.m...s.~...t.....v.....w.....y.....z.....\|.....}.........................................................................+.....D.....].....z.....?...........~...........).............................O.................T...........#.....E...........:.......................w.................W................./...........F.................V...........5.....T...........K.................3.............................o...................................E.........../.....a.....t.............................z...........,.....?...........5.....v.................q.................5.......................r.................1...........X.................I.......................y.................$.................k...........).................!.......................#.................7.....P...........e.......................e.............................w...........W ..... ....$!....K!.....!....7"....g"....."....@#.....#....-$

C:\Users\user\AppData\Roaming\GamePall\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1167065
Entropy (8bit):	4.308980564019689
Encrypted:	false
SSDEEP:
MD5:	1FF8A0B82218A956D2701A5E4BFA84EF
SHA1:	56BB8218963E14ADCC435F2455891F3A0453D053
SHA-256:	62E7C3ABC317931723BE11ADD3712DD15EAAB0A35A4D8E7DB0B6347104EC5733
SHA-512:	3330D983401953AA5ED4856A8D10FFCBEEFC2A4E594CF850566A0AD38837BC1164870BB1270B6BBE5D7DD6FB1ECA29CDE85869A5C51808B901CDC282E04764E4
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.%...n.-...o.2...p.?...q.E...r.Q...s.b...t.k...v.....w.....y.....z.....\|.....}...............................................................................?.....j.............................................../.....j.........................................N.....}.....P...........^...........F...........A.....d.....K...........N.............................L.....&...........V...........f...................................L.....~.................{.................A.................y..........}...........;........................................[.................,.....K...................................j ..... ..... .....!....J".....".....".....#.....$....T%.....%....@&.....&....8'....d'.....'.....(.....(.....(.....)....6..........*.....+.....,.....-....c-......................%/.....0.....0.....1.....1.....2....i3.....4....B4.....5.....6.....7.....7.....9.....9....S:.....:.....;.....<....F=.....=.....>....N?.....?.....@.....@.....A....LB

C:\Users\user\AppData\Roaming\GamePall\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	526575
Entropy (8bit):	5.518614920030561
Encrypted:	false
SSDEEP:
MD5:	0BD2F9847C151F9A6FC0D59A0074770C
SHA1:	EA5313A194E9D99489E9F1D7B4DFC0BC986C8E17
SHA-256:	5F2F1AA2E2EC78F375084A9C35275E84692EE68A1E87BBEF5A12A2C0FCF7F37A
SHA-512:	0032C0B41FDF769DAA1AF23C443D4195B127DF9EA8621174F1AABDBAFAE4954383095FA1EEAD14FC458188B8837BBE9AECA0D5338E4D47F10D976FBED8609496
Malicious:	false
Reputation:	unknown
Preview:	........F$s.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.)...y./...z.>...\|.D...}.V.....^.....c.....k.....s.....{.................................................................k...........Y.....z...........F.....~...................................e.......................y.......................m.......................l................. .................q................._.........................................A.............................4.......................j.......................D.....f.....w.................*.....:.................4.....I.................&.....5.................8.....M................. .....0.........................................S.....n.................0.....M.......................3....................... .................E.....v...........!.....F.....\...........).....[.....t...........U.................M...........(.....:...........".....`.................G.....v.................$.....B.....T...........0.....n.

C:\Users\user\AppData\Roaming\GamePall\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	566819
Entropy (8bit):	5.6387082185760935
Encrypted:	false
SSDEEP:
MD5:	4C27A1C79AB9A058C0A7DFFD22134AFD
SHA1:	5F0A1B34E808B91ADB1E431E462D9FCF82F4FFF2
SHA-256:	AD98C0A367B51EB217E69D66FA6A946946E85EC8452FC5A7AE0F179F35BE28C3
SHA-512:	0F066DB5905EB24B6CB4FBC7C81F017B43AFB7A6E975886644D871E979406B990509905D100653496EE2D20969A77434B702FF1EA5D348274AE54EA597A91D5E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.!...j.+...k.:...l.E...n.M...o.R...p._...q.e...r.q...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................+.....A.....V.....j.................9.....W...........N.............................................".....X.....q...........K.....r.................Y.................?................."...........I.................7.......................k...........'.....7...........:................./.................:.................Z.....w...........O.....v.................f.................5.................(...........2.....u...................................M.................0...........6.....x...................................m.................)................. .....I.................O.....g...........c.................O.......................E.......................r...........'.....H...........v.............................l...........7.........................................5...........& ....q

C:\Users\user\AppData\Roaming\GamePall\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	466959
Entropy (8bit):	5.379636778781472
Encrypted:	false
SSDEEP:
MD5:	1466C484179769A2263542E943742E59
SHA1:	18E45A08661FD6D34BADE01CDB1E1D5184BA2B67
SHA-256:	C331293D16B16B08DEF73BE73437845D58C593941320C547A377DB423749AEBB
SHA-512:	ABC54D5CAAA663578F064E43CC0465BEB97EFC46991936708EBF3FCD64BD007E47072AB4834A5361B21F064BB0F6527E247BC2C2F0DFB8336F50C2FF3E15A59C
Malicious:	false
Reputation:	unknown
Preview:	........ $..e.6...h.>...i.O...j.[...k.j...l.u...n.}...o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.........................'...../.....6.....=.....D.....E.....F.....H.....V.....c.....s.................k................. .....l.......................l.................-.......................0.............................R.....s.................I.....x.................T.......................@.....j.....w.................L.....Y.................Z.....m...........H.......................%.....@.....Q.............................c.......................<.......................#.....t.......................L.....x.................%.....R.....^.................>.....K.................5.....G.............................J.......................".....h.......................L.....}.................#.....=.....K.................+.....:.................2.....K...........C.......................u.................,.....\|.......................C.....b.....r...........1.....h.

C:\Users\user\AppData\Roaming\GamePall\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	522800
Entropy (8bit):	5.284113957149261
Encrypted:	false
SSDEEP:
MD5:	7767A70358D0AE6D408FF979DF9B2CD4
SHA1:	9C57A5B068DC12AAF1591778DEF5D3696377EDAB
SHA-256:	672908E77E9EACA793654C8E630442099DE3BE772FD3230A9C4045CAFBCC0B1E
SHA-512:	913AA8C49D04CD84706D08A88453D1ED36FDE6A00F7C1DF63DECEA99316A8A234924457C0C50937329B3979E437B1C2D7796E63ADF209505E212FDCEAE3BFDB5
Malicious:	false
Reputation:	unknown
Preview:	........-$..e.P...h.X...i.i...j.u...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.$.....,.....1.....9.....A.....I.....P.....W.....^....._.....`.....b.....u.......................E...........3.....O.................V.....g..........._.................o...........#.....L.............................k.......................n.................2..................................w.................5.......................R...................................c................./.....[.....y.................=.....K.............................x..............................................`.......................4.............................^.........................................B.............................F.....\.....r........... .....L.....a...........=.......................b.......................8.....c.....v...........[.................c...........S.....j...........d.................[.................).....v.......................X.............

C:\Users\user\AppData\Roaming\GamePall\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	634636
Entropy (8bit):	5.718480148171718
Encrypted:	false
SSDEEP:
MD5:	4A4AF69546DCF65F2D722A574E221BEA
SHA1:	EE51613F111CF5B06F5605B629952EFFE0350870
SHA-256:	7AD195AF107F2A394BAB527C3E84E08F3B7748076F23459F084CF0E05DD29655
SHA-512:	0E93F6B22F7C9176EFC9D49901BFBD281FA5AC3632780DFA76CE597CADD8C1CF570A9163A86BC320BBFBD354F48288DBEC5E36A6088999B00A3561D302A96D03
Malicious:	false
Reputation:	unknown
Preview:	........n#K.e.....h.....i.....j.....k.....l.....m.....o.%...p.2...q.8...v.D...w.Q...y.W...z.f...\|.l...}.~...............................................................................................6.....W...........}.................l........... .....8...........c.......................B.................W.......................x...................................7.....V...........e.................=.......................].......................{...........#.....2...........y.................`...................................<.....W...........j.................y...........e...................................h...........(.....:...........%.....a.....p...........{.................}...........m..................................._...................................Z.....x.............................o...................................:.....U................d.....z....."................?...........X.................`.................@.................g............ ..... ..... .....

C:\Users\user\AppData\Roaming\GamePall\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1256908
Entropy (8bit):	4.247594585839553
Encrypted:	false
SSDEEP:
MD5:	6A41A5AB03A22BDAEC7985B9A75EC11A
SHA1:	6BB02DF557BD6522E02FE026C0243BEB9332B2E5
SHA-256:	E22873652AC7D9D18E47DAE838D121B5644EDA4C67F7B0BC110733BF7E931FEA
SHA-512:	BCA661D802D29463A847AC77EB8D5DFA41C31455E7314049CA26555957DCA3BE33701C074F7ED26D2C375A0A9C5F8A93461007B8D74F5ED3BD27C02E5DB170A5
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}.................................................................W...........".....V.....W...................................n...........b............................._.......................<.....)...........s.......................).............................1.....7...................................[......................................................................u...........f...........K.....^........................ ..... .....!..../"....i"....=#.....#....r$.....$....I%.....%....l&.....&....p'....((.....(.....(.....)....N...............,.....-.....-................./.....0....W0.....0....z1.....1.....1.....2....Y3.....3.....4....@5.....6.....6.....7.....8.....8.....9....V9.....:....R;.....;....1<.....=....B>.....?....]?.....@....DB....BC....wC.....D.....E.....F....$G....\H....AI.....I....4J.....K.....K.....L....PL.....M....lN.....O

C:\Users\user\AppData\Roaming\GamePall\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532715
Entropy (8bit):	6.0824169765918725
Encrypted:	false
SSDEEP:
MD5:	5FD9942F57FFC499481947DB0C3FDFA7
SHA1:	4D60AB21305902877467FF6151C1B7AB12553AAE
SHA-256:	09E279860E20E9E559945940E29446CAD4273D05C5F3F15D0BAD664A1D5749F2
SHA-512:	97953E580588C07769F1BD0002E2DF648FFCE5B246D2359E4475EDCFA1CD6E7286BAF168A115D7A65686B2151C313B6FD0C271E40B1F9DD4132F2F39904FE8D4
Malicious:	false
Reputation:	unknown
Preview:	........O#j.e.....h.....i.....j.....k.....l.....m.....o.....p.....q.....r.....s.....t.....y.#...z.2...\|.8...}.J.....R.....W....._.....j.....r.................................................................].................5.................O.....b...........F.......................p.................'.......................,.......................;.......................L.......................e.......................Y.......................X...................................Q.....h.................>.....U................. .....0.........................................-.....I.................A.....Q.................L....._.................K.....[.................J.....Z...........O.......................Z.....{.................U.....}.................`.................%.......................J.............................h.......................\.................+.......................m.........................................'.............................x.........................

C:\Users\user\AppData\Roaming\GamePall\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	573015
Entropy (8bit):	5.63016577624216
Encrypted:	false
SSDEEP:
MD5:	8745B87D09D9ECC1112C60F5DD934034
SHA1:	2F411E4EEF0E656CAC0C755FECE1AD2531CB689E
SHA-256:	D546C994C81510122E7B2359DA50F694E1F0CA4081830404E16187A5CF4D4E0D
SHA-512:	27B658C153A01AABB9595C5B1059567E535EDFC8F8187B89316D2C85694DE32696D209CFDD2A32C4826DFB1E50AC692937156563EE190E68DB358C40F9AAE15F
Malicious:	false
Reputation:	unknown
Preview:	........+$..e.L...h.T...i.e...j.q...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}. .....(.....-.....5.....=.....E.....L.....S.....Z.....[.....\.....^.....l.....y.................4...........".....=...........S.................M...........'.....A...........8.....p...................................A...................................B.....g...........z.................R...................................;.....K...........c.................T...........2.....P...........2.....Y.....t...........W.........................................E...................................D.....S...........Q.........................................S.............................B.................&.......................t...........1.....Y...........K.................+.........................................'...........N.................A.................,...........q.................d...........&.....F...........x.................(.......................H ..... .....!

C:\Users\user\AppData\Roaming\GamePall\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	570683
Entropy (8bit):	5.624052036286866
Encrypted:	false
SSDEEP:
MD5:	E16B0B814074ACBD3A72AF677AC7BE84
SHA1:	10744490B3E40BEB939B3FDCA411075A85A34794
SHA-256:	46B5C09AA744AF0F660C79B0CDBDE8C8DBDD40A0BA1A23AAF28D37ECC4211DC5
SHA-512:	70EA9DFAC667C0992AE0E95815A47EB8E779BAAE1215E733AFE84EEE26D3BA754AD838C12E9AEE3114D7BBE11CD21B31C550F5CAFE6C5E838B69E54C6174EF18
Malicious:	false
Reputation:	unknown
Preview:	........O$j.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.;...y.A...z.P...\|.V...}.h.....p.....u.....}...................................................................................Z.................G.................%...........Z.................F.................6.................Q.....\...........Q.........................................\|.....#.....t...................................W.................0...........T.................B...........8.....Y...........$.....J.....`...........-.....V.....h...........;.....b.....v.............................G.......................r.........../.....>...........'.....Z.....k...........c.................@...........3.....K.................).....>...........=.....t.................c.................(.................2.......................8...........<.....q.........................................:.................8...................................N.....^...........0.....K.....m............ .....

C:\Users\user\AppData\Roaming\GamePall\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1307271
Entropy (8bit):	4.279854356980692
Encrypted:	false
SSDEEP:
MD5:	309E068B4E15157486D095301370B234
SHA1:	D962CDAF9361767045A928966F4323EAD22D9B37
SHA-256:	4F2C19B7E94B695C5C5CAB95DEE6E49AE53C3337C351B5C665BCB6BA4E6AE909
SHA-512:	6B1333946C7950D97D2DF29D063DB39A0EC5C0EEAA1ECA40743E4A6A0E4C972D897D3FF2BA837B53E31B8003F2C5C4BACCB7A4AB4B50C6CB47DF39AD7B8E05E7
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.,...w.9...y.?...z.N...\|.T...}.f.....n.....s.....{...........................................................$.....d.................Z.....C.......................W...........%.....r.....a.......................}.................n...........................................................I.................m.......................l.......................5.....y.............................^.............................j.......................\|............ ..... .....!.....!....".....#.....#....V$.....$....n%.....&.....&.....&.....'....n(.....(.....)..........*....W+.....+....c,....+-.....-.....-...........0.....0.....1.....1.....2....!3....Y3.....4.....4.....5....T5....06.....6.....7.....7.....9.....9.....:.....;.....;.....<.....=....Z=....\|>....s?.....@....T@.....A....UB.....C....SC.....D.....E....yF.....F.....G.....H.....I.....I....-K....(L.....L.....M.....N.....N....eO.....O.....P.....Q.....R

C:\Users\user\AppData\Roaming\GamePall\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1075591
Entropy (8bit):	4.313573412022857
Encrypted:	false
SSDEEP:
MD5:	69C36C23D6D9841F4362FF3A0F86CFDF
SHA1:	C4C1F632EB8373107AEEBD6C26ECF036AEDA2B6B
SHA-256:	6A794C2B08F8B046BE771DF33719536BDAF2371E3825D49A0E556958B781832D
SHA-512:	8C1329BDB371677BC0A9D727A38591EDF32025BAE1E7EFE402D01C6A8BB5F647D827C59A18F40455D5C9C0482798525C98C3F1C8AC568AA886D7C1ED07D1580E
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i."...j.....k.=...l.H...n.P...o.U...p.b...q.h...r.t...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................@.....b.................%.....]...........W.................J.............................:.....@.....=...................................&.................&.....F.....P.......................h...........o...............................................c...................................R..........._.................i...............................................J.................. .....!.....!....(".....#.....#....O$....{$....B%.....&....c&.....&....F'.....(...._(.....(....R).........y.....*.....+.....-.....-................./...../...../.....0....61....l1.....1....Z2.... 3.....3.....3.....4.....5.....6.....6.....7.....8.....9....E9....u:....n;.....;....@<.....=....O>.....?....5?.....@.....A.....B.....B....MD....WE.....E....eF....nG....LH.....H.....H.....I.....J.....J.....K....5L....)M.....M

C:\Users\user\AppData\Roaming\GamePall\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	489457
Entropy (8bit):	5.250540323172458
Encrypted:	false
SSDEEP:
MD5:	A1253E64F8910162B15B56883798E3C0
SHA1:	68D402D94D2145704DC3760914BF616CC71FC65D
SHA-256:	E033BFAD6CD73EA7B001DFAF44B7102E3BBE2A1C418F005C149E4FB2565DB19F
SHA-512:	ABD63713093049ECC8E24FD8145EAE065340058A3C38758A59EE8796FBED7E6CFBC54982D650889F1CEB54797060C7DDA12EEE2A963B14C5E907A110C2057DBE
Malicious:	false
Reputation:	unknown
Preview:	........T$e.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v./...w.<...y.B...z.Q...\|.W...}.i.....q.....v.....~........................................................................................._.....{...........:.....n.....~...........\.................#.......................=.......................1.......................3.......................Y.................*.....z.......................W.......................E.......................b.........../.....A.............................N.......................$.....x.......................r.......................z.......................p.......................^.......................Q.......................r.................!.....s.......................S.....w.................6....._.....p.................T.....w.......................#.......................$.................2.....K...........B.......................s.................,.............................P.....r.................0.....].

C:\Users\user\AppData\Roaming\GamePall\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	476208
Entropy (8bit):	5.4272499712806965
Encrypted:	false
SSDEEP:
MD5:	622ED80836E0EF3F949ED8A379CBE6DF
SHA1:	9A94CD80E747B88582470EF49B7337B9E5DE6C28
SHA-256:	560B2F09C1B6E6BB7E6A5A5F9BF85A88BD2ACA054B7D4A5955D9C91B6D7CA67C
SHA-512:	950627E74180E1451BB35AE4A7416AC14D42D67BBBB59DC51D7B69E4CEB61715F8F9B0EB9D7F35FCEFD4D43FABE5CE2103F1AF3709CAE6733C25AC19E6339A83
Malicious:	false
Reputation:	unknown
Preview:	........2$..e.Z...h.b...i.y...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.....}.......................N...........A.....V.................X.....k...........z.................K.......................L.......................:.......................;.......................g................./...........<.........................................R.................1...........Q.......................\.....u.................1.....V.....f.................9.....I.................H.....\.................J.....Z...........".....T.....d.................@.....P.................<.....J...........4.....y.................B.....h.....{...........&.....E.....^.................-.....?...........,.....k.................V.....\|.................b.......................i.................&.......................s...........9.....b...........*.....V.....i.................".....0.................).

C:\Users\user\AppData\Roaming\GamePall\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	491139
Entropy (8bit):	5.362822162782947
Encrypted:	false
SSDEEP:
MD5:	C8378A81039DB6943F97286CC8C629F1
SHA1:	758D9AB331C394709F097361612C6D44BDE4E8FE
SHA-256:	318FB294CE025BDA7636B062CA7B6A1FB1E30C485D01856159CB5DB928782818
SHA-512:	6687FFE4DE0D5A2314743EB3134096292724163D4E0332D2F47922B4807B0CDE7C20E2D57D2662E403D801BC7A20BC247F5D0EDD787AB650E5766B49AF7D3C63
Malicious:	false
Reputation:	unknown
Preview:	.........$..e....h.2...i.C...j.O...k.^...l.i...n.q...o.v...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................#..........1.....8.....9.....:.....<.....H.....X.....i.....{.............................X.......................\|...........4.....J.................M.....d.................8.....G.......................).................8.....Y...........1.....h.................F.....{.................U.........................................\.................4.............................Y.......................-.....~.......................}.......................v.......................V.......................5.....a.....n...........*.....^.....m...........I.......................X.......................>....._.....v...........,.....T.....f...........8.....o.................=.....[.....o...........3.....e.....v...........H.....................................................E.....j...........5.....f.....{.................B.....R.................B.

C:\Users\user\AppData\Roaming\GamePall\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	550453
Entropy (8bit):	5.757462673735937
Encrypted:	false
SSDEEP:
MD5:	80C5893068C1D6CE9AEF23525ECAD83C
SHA1:	A2A7ADEE70503771483A2500786BF0D707B3DF6B
SHA-256:	0069648995532EFD5E8D01CC6F7DD75BD6D072E86C3AE06791088A1A9B6DACC4
SHA-512:	3D1C41A851E1CF7247539B196AD7D8EE909B4F47C3CFB5BA5166D82CDA1C38049B81A109C23FA6D887490E42EE587CC2A6BD96A3EA890267C089AC74710C755F
Malicious:	false
Reputation:	unknown
Preview:	........6$..e.b...h.j...i.{...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|."...}.4.....<.....A.....I.....Q.....Y.....`.....g.....n.....o.....p.....r.............................X...........S.....o...........=.....w...................................i...............................................z.................$.................1.....W...........M.................*.......................@.......................l...........0.....L...........].................9.....v.......................E.....h.....x.................,.....:.................<.....P.................>.....P.................6.....F.......................-.........................................e.....}.................4.....K.......................;.................+.....@.................a.................+.....I.....`.................9.....U...........2.....}...................................w...........'.....R.................9.....J.............................v.............

C:\Users\user\AppData\Roaming\GamePall\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	516256
Entropy (8bit):	5.426294949123783
Encrypted:	false
SSDEEP:
MD5:	3BA426E91C34E1C33F13912974835F7D
SHA1:	467A1B05BAD23252A08EE22E6B9EBB4404F6A0F0
SHA-256:	CB66D88D3B3938FE1E42C50ECB85CEDB0D57E0F0AB2FA2A5FC0E4CDEA640E2B7
SHA-512:	824A4301DC4D935FF34CE88FAA0354440FC1A3A8E79B0F4B0B2DCC8F12542ECEF65828FB930EDF5B35BF16863296BBAE39E9306962B4D3CFA9F6495AC05BDEF4
Malicious:	false
Reputation:	unknown
Preview:	........9$..e.h...h.p...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.$...\|.*...}.<.....D.....I.....Q.....Y.....a.....h.....o.....v.....w.....x.....}.............................d...........L.....h.........../.....h.....x.............................w.................(.....y.......................^...................................:.....j..........._.................:......................._...................................K.....d...........p.................5.............................q.......................n.......................w.......................p.......................O.....}.................).....W.....a.................V.....g...........b................. .....j.......................;.....a.................=.....U...........N.................2.....W.....p...........8.....p.................S.................@.................0...........1.....{.................X.......................0.....V.....k...........C...................

C:\Users\user\AppData\Roaming\GamePall\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	518861
Entropy (8bit):	5.4029194034596575
Encrypted:	false
SSDEEP:
MD5:	4D7D724BE592BD0280ED28388EAA8D43
SHA1:	8E3C46B77639EB480A90AD27383FBB14C4176960
SHA-256:	4724D82866C0A693C2B02D1FFA67D880B59CDB0D3334317B34EC0C91C3D3E2A2
SHA-512:	D05388F66C50E039F7D3393515740F6B2593F9C0EF8651F9CDE910C5FF06656E0D22FDB066B22665289EE495837EA16CC085ECB3F85B0F6FB498AECDAA19ADF7
Malicious:	false
Reputation:	unknown
Preview:	........I$p.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v."...w./...y.5...z.D...\|.J...}.\.....d.....i.....q.....y.......................................................................u...........Z.....u...........@.................).................$.................S.....w.................D.....T.................(.....:...........(.....j.................x.................H.......................g...................................9.....N...........D.......................p.......................^.......................a.......................q.......................r.......................U.............................[.....e.................P.....a...........?.......................O.....y.............................?.................0.....J...........#.....p.................9.....c.....u...........#.....Y.....n.........../.....}...............................................G.....k...........N.......................B.....g.....\|...........J.......

C:\Users\user\AppData\Roaming\GamePall\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	537125
Entropy (8bit):	5.4566742297332596
Encrypted:	false
SSDEEP:
MD5:	4F1C0A8632218F6FEF6BAB0917BEB84F
SHA1:	05E497C8525CB1ADE6A0DAEFE09370EC45176E35
SHA-256:	9C19835F237B1427000D72C93703311CFCBEFF6C2B709474B16DB93E629BC928
SHA-512:	A7CDF94F79CD888BB81FD167F6B09BF1BEF2C749218869E5A12A0A3B2C2506D1A63F64B63D8E48EA49375636041C639082563BF9D526FE44003FC5A5E8D50E9D
Malicious:	false
Reputation:	unknown
Preview:	........0$..e.V...h.^...i.o...j.y...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.(.....0.....5.....=.....E.....M.....T.....[.....b.....c.....d.....f.....u.......................3.................+.................%.....9...........@.................1.......................Q.......................4.......................C...................................>.....b...........@.......................d.........................................p...........@.....n.................+.....H.............................h.......................M.......................J.......................7.............................].......................E.....t...................................?.............................W.....w.................\.................).......................f.......................W.........................................'...........$.....y...................................f.......................j.......................l...........+.

C:\Users\user\AppData\Roaming\GamePall\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	878725
Entropy (8bit):	4.848685093578222
Encrypted:	false
SSDEEP:
MD5:	3A3D0D865A78399306924D3ED058274E
SHA1:	AA1A42DB6021666B2297A65094D29978792CE29B
SHA-256:	EAB4C32FEBE084CC7A3A272CDA008B69D6617ED6D042376B0316BE185B9E66FE
SHA-512:	ACA8C87D0B2BB35A325726F7774F8A0232B99C8EFE0F948AB68210958E23B95E9D9026A9430D96FC2D5CEBA94815F4217896EF877C9A6E1D0E56F73533FB1D12
Malicious:	false
Reputation:	unknown
Preview:	.........#/.e.....h.....i.#...j./...k.>...l.I...n.Q...o.V...p.c...q.i...r.u...s.....t.....v.....w.....y.....z.....\|.....}.........................................................................9.....V.....n...........V.......................g...........i...........l.....).................g...........,.....f.......................@.................6.....M......................./....."...........l..........._...........D.....y..... .................&.......................5.....9.....3.............................B.................r.................D...................................=.....b.........................................E.....\...........Y.................'...................................D.....n...........j.................9.......................a...........i...........v...........t...........a........................ ....,!....l!.....!....j"....."....R#....\|#....O$.....%.....%.....%.....&....x'.....(....Q(.....(....z).....).....)....]..........+....$+.....+.....,.....-

C:\Users\user\AppData\Roaming\GamePall\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	553886
Entropy (8bit):	5.812150703289796
Encrypted:	false
SSDEEP:
MD5:	A9656846F66A36BB399B65F7B702B47D
SHA1:	4B2D6B391C7C2B376534C0AF9AA6779755B4B74E
SHA-256:	02B65F48375911C821786D91698E31D908A4C0F5F4F1460DE29980A71124480E
SHA-512:	7E23CAA89FF80BF799AC5353CEAF344CBED0393F23D15FCBE8DC24EE55757F417CEA3BFC30889FD2CB41951F9FA5629C2E64B46DD9617D4A85EFEF0A255246F6
Malicious:	false
Reputation:	unknown
Preview:	........5$..e.`...h.h...i.\|...j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.%...}.7.....?.....D.....L.....T.....\.....c.....j.....q.....r.....s.....u.............................h...............................................[.........../.....I.................S.....j...........9.....h.....{...........4.....].....q...........J.................?.............................%.....`.....y...........\................./.............................%.....v.................G.....g.....\|...........=.....c.....u...........6.....].....o...........O.........................................".......................3.......................R.............................-.....x.................0.....K....._.................0.....E.................G.....W...........T.................).....w.................-.......................M.............................O.................J.........................................'.........................................E.

C:\Users\user\AppData\Roaming\GamePall\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	532410
Entropy (8bit):	5.486224954097277
Encrypted:	false
SSDEEP:
MD5:	BE49BB186EF62F55E27FF6B5FD5933F4
SHA1:	84CFD05C52A09B4E6FA62ADCAF71585538CF688E
SHA-256:	833F2E1B13381AA874E90B747931945B1637E53F2396A7409CCDA0A19CBE7A84
SHA-512:	1808631559D3C28589D3F5A4B95554CEBC342DE3D71B05DDC213F34851BF802967BFFAC3D7668C487265EE245D1E26EFCE5D317EDBFBBEEB4BC2C9F122980585
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.6...i.G...j.Q...k.`...l.k...n.s...o.x...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................%.....,.....3.....:.....;.....<.....>.....P.....^.....n...................................y.................&...........2.....}.................h.......................g.......................Z.......................v.................O...................................3.....I.................T.....h...........b.................S...........$.....J.......................(.............................n.......................z...........$.....8.................2.....C...........).....j.................;.....i.....\|...........?.....q.................[.......................g.......................L.....j.................G.......................~.................I.......................B.......................b.............................^.............................o.........................................j.......................x.......

C:\Users\user\AppData\Roaming\GamePall\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	818089
Entropy (8bit):	4.779985663253385
Encrypted:	false
SSDEEP:
MD5:	AFA2DFBA3BD71FE0307BFFB647CDCD98
SHA1:	CD7A5C54246E891981AEEEAA88D39EC9E3F2C594
SHA-256:	1375353837629A20102C69BF62701EE5401BED84D3DC4845BED5EE43E4D322CF
SHA-512:	CE8BBBDDC33CB6B8DF4AEE127A8987E6D8C1D0761AC5BD25D685310BAA2D377F239BDF06F2C04B54295CF8FD440697A69A040644D5A7C0395C4F71A0252B8E87
Malicious:	false
Reputation:	unknown
Preview:	........=$\|.e.p...h.x...i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.,...\|.2...}.D.....L.....Q.....Y.....a.....i.....p.....w.....~.........................................).................W...........O...........\...........z.....E...................................3...........b.................a.................5.......................1.....1...........v...........\|...........{...........`...........Y.....~.....d...................................S........... .......................{...........(.....K...........H.................c...........d...........3.................)...........B.................D.................(...........W.......................E.................~...........'.....O...........^.................~ .....!....]!....z!....J"....."....=#.....#....0$.....$.....$.....%.....%....P&.....&.....&.....'....1(.....(.....(.....).....*....5+....S+....A,.....,....Z-.....-....^...........=/....^/...../....Y0.....0.....0.....1....'2.....2

C:\Users\user\AppData\Roaming\GamePall\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	479512
Entropy (8bit):	5.541069475898216
Encrypted:	false
SSDEEP:
MD5:	09592A0D35100CD9707C278C9FFC7618
SHA1:	B23EEF11D7521721A7D6742202209E4FE0539566
SHA-256:	9C080A2F6D4EDF0E2E94F78550B9DB59ADF5B1B9166DE2BAE496E6ABB6733304
SHA-512:	E0760B3F227A3E7EAEB4816B8E02BEE51C62730D24403724D66B36BCCBC0BDCD56DF9EAB28B073AB727EE12C8856A858E52A9803E1A1C9164FCD3CF2F716D8AF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.....h.....i.....j.%...k.4...l.?...n.G...o.L...p.Y...q._...r.k...s.\|...t.....v.....w.....y.....z.....\|.....}.........................................................................#.....5.....I.....]...........b.................).......................e...........2.....K.................T.....p...........&.....U.....e...........%.....V.....f...........J.........................................O.......................Y..................................._.....u.............................n.......................J.......................'...............................................(.............................z.......................j.......................h.......................\|.................$.....w.......................M.....k.......................?.....Q...........).....f.................J.....i.................;.....c.....x...........1.....l...................................q.................?.................;.....N.............................p.............

C:\Users\user\AppData\Roaming\GamePall\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	504856
Entropy (8bit):	5.34516819438501
Encrypted:	false
SSDEEP:
MD5:	9E038A0D222055FED6F1883992DCA5A8
SHA1:	8FA17648492D7F093F89E8E98BF29C3725E3B4B5
SHA-256:	DDCA575D659545D80E715EB4176BBBBFBD3F75E24B223537B53740B0DCB282BD
SHA-512:	FB70F97E08191DFEB18E8F1A09A3AB61687E326265B1349AB2EFF5055F57E177A496BF0EA3592B61C71FE1F73C9143CA1495B05226F36EB481024827CAE6DCC4
Malicious:	false
Reputation:	unknown
Preview:	........4$..e.^...h.f...i.q...j.}...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.,.....4.....9.....A.....I.....Q.....X....._.....f.....g.....h.....m.............................?.................$.................2.....D...........7.......................P.......................A.....l.....{...........&.....U.....c...........0.....d..................................._.......................m.......................n.............................*.......................J.....r.......................>.....G.........................................A.....O.................4.....F.................G.....R.................).....6.................).....2.................\.....u...........(.....T.....p...........2.....c.................D.......................l.................B.............................j.................+.......................j...........?.....S...........5.....x...................................P.......................r...........%.

C:\Users\user\AppData\Roaming\GamePall\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1298313
Entropy (8bit):	4.058495187693592
Encrypted:	false
SSDEEP:
MD5:	36104CB0D5E26E0BBB313E529C14F4B4
SHA1:	69A509DEE8419DA719DCF6DE78BFE0A6737508C5
SHA-256:	DC28C869A143424F71EDCFDB08B56DA31C2EC96E9D608535FFA7DC0B0842B7D8
SHA-512:	D46ED1AA19EB298BC4C3D61EFC28D80753D6B551F01808E6158A0869FAAE8755DF61D4B4BAFF1310DD09FCFC385ABA67E1AA7D61BBE399DF7BB2D483EBE0FEFF
Malicious:	false
Reputation:	unknown
Preview:	.........$..e.(...h.0...i.A...j.M...k.\...l.g...n.o...o.t...p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}...............................!.....(...../.....6.....7.....8.....=.....k.................:...........5...........$.....v...........`...........(...........Z.................%.............................O...........j.....L.........................................m...........u...................................;.....c...........7.................................................................8 ..... ....m!....I".....".....".....#.....$.....%....9%....d&....n'.....(....L(....C)....4..........*.....+.....,....3-....a-....Z.....J/...../...../.....0.....1....Z2.....2.....3....:5.....6....Z6....U7....=8.....8.....8.....9.....:.....:....F;.....<.....=.....=.....>....E?....S@.....@....[A....3B.....B....IC.....C.....D.....E....[F.....F....+H....>I.....J....pJ....\L....FN.....O.....O....DQ....QR.....S....{S.....T.....V.....V....'W....+X.....Y.....Y.....Y.....[....9\.....\

C:\Users\user\AppData\Roaming\GamePall\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1199612
Entropy (8bit):	4.314031920337284
Encrypted:	false
SSDEEP:
MD5:	98714389748A98ECC536CD2F17859BDF
SHA1:	07761AA31588F30C2CED4A1E31FE99DDC43A5E8D
SHA-256:	8A81B1A5457407E49D6372677938E7A2D28DFCA69F555FEDC8A2C9C09C333A65
SHA-512:	38CC4F064BD874EEC9DBFAB4C2A83A487FBCD89CEFB40BE4213C42231BC48AF9255341C9D325EE059BC50EE533898C5FA22CD3B3927A8E045049DEF3C5DFB2C6
Malicious:	false
Reputation:	unknown
Preview:	........N$k.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.....s.....t. ...v.5...w.B...y.H...z.W...\|.]...}.o.....w.....\|.......................................................................X...........J...........\|...............................................f.........................................~.............................Y.............................A.............................d.....X.........../.....k.....b...........5...............................................'.......................L.....u ....:!.....!.....!.....".....#....$....k$.....%.....&....6'.....'.....(.....)........._*.....+....P,.....,.....-....'...........m/...../.....0.....1...."2....f2.....3.....4....R5.....5.....6....G7.....7.....7.....8....I9.....9.....9....{:....0;.....;....)<.....=.....>.....?.....?.....@....bA.....A.....B....JC....(D.....D.....D....DF.....F.....G.....G.....I....@K....qL.....L....4N....EO.....O....pP.....Q.....R....?S.....S.....T....^U.....U.....V....`W....[X.....Y

C:\Users\user\AppData\Roaming\GamePall\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	1008989
Entropy (8bit):	4.356501290091745
Encrypted:	false
SSDEEP:
MD5:	56F29DE3465795E781A52FCF736BBE08
SHA1:	EAA406E5ED938468760A29D18C8C3F16CF142472
SHA-256:	529C561747BF8B6206BE4F8BCF287A1D15E1B14A33113242DDAD5E035CA37BE6
SHA-512:	519B5B3CC7032B2AF856456EEC25019B3A6A7F2A6DB7A0318CF87C41E08C6F6BFA73E239939B0DA16972C1D357FF06177765D875E19742D23E99A95FD4AC5416
Malicious:	false
Reputation:	unknown
Preview:	........i#P.e.....h.....i.....j.....k.....l.....o.....p.....q.....r.....s.0...t.9...v.N...w.[...y.a...z.p...\|.v...}.....................................................................................'.....{.......................^...........e...........f.................s...........I...........]...........P...........r.................{...........D.....]...........;...........$.................,.....}.....K...........v...........e...........r...........m.....................................................E.......................P.......................:.......................B.......................b.......................s.......................X.......................S..................!.....".....".....".....#....0$....\|$.....$....j%.....%....5&....l&.....'....z'.....'....!(....A).....)...............+.....,....H,....x,....M-.....-....6.....l.....k/...../....o0.....0.....1.....2....>3...._3.....4.....5....c6.....6.....7....n8.....8.....9.....9....f:.....:.....:.....;.....<....D=

C:\Users\user\AppData\Roaming\GamePall\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	515329
Entropy (8bit):	5.616482888977033
Encrypted:	false
SSDEEP:
MD5:	46CA9EE922C3C175DE466066F40B29CE
SHA1:	5563E236A15CD9CC44AE859165DF1E4E722936C7
SHA-256:	BD8B1441FD2057F0B61512CC0AA23DFD2619560CF886B4D453FA7472E7153A3F
SHA-512:	45AA2D6896568751C2F986ABD281EA07CB731880DF8F28F2F0AEFD95736F41B1E005D8DFB6F0AEF0CED6CEF94154D34FD0DA2CB7F0B0C66D9C085F5C47F32605
Malicious:	false
Reputation:	unknown
Preview:	........c$V.e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.%...s.6...t.?...v.T...w.a...y.g...z.v...\|.\|...}...........................................................................................)...........L.................+.......................e........... .....;.................7.....J.......................)......................................... .....B...........5.....x.................Z.......................Q.....{.................w.................Q.................!.......................'.......................&....................... ................."...../.................5.....F.................9.....F.................2.....>.................7.....D...........I.......................v.......................i.......................P.......................q.................-.....z.......................m.................,.............................*.................B................."...........(.....n.................N.....~.................l.......

C:\Users\user\AppData\Roaming\GamePall\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	876131
Entropy (8bit):	4.88404350774067
Encrypted:	false
SSDEEP:
MD5:	1365ABDD1EFB44720EA3975E4A472530
SHA1:	8421FC4905C592EB1269C5D524AA46866D617D3C
SHA-256:	29AB0F7EE69FB7A1E1E54DD2A3746D2CFEAAA71AE5971EE30AA8E2E0F6556FA5
SHA-512:	2E806A9BEA864E689BBD1D78B800DFDBC6E4109320F9A4790E52010BFDEC20C7644655A6FE3BABDE0B84D9580208CB78EF1FA0DB3476F8676C17A13D130296C7
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r.'...s.8...t.A...v.V...w.c...y.i...z.x...\|.~...}.....................................................................................1.....s.....W.......................r...........x...........m.....!.......................<.............................n...........,.................-...........\|.............................=.....y.....+...........%.....K...................................w.............................N...................................r.................O...........N.................^...........\...............................................h...............................................R.....m.....f.....6.............................W.....y...........O.....x...........K...........j...........z .....!.....!.....".....".....#....R#.....#....&$.....$.....$.....%.....%....s&.....&.... '.....(.....(....~).....).....*....Q+.....+.....,.....,....Z-.....-.....-....[............/....4/.....0.....0....$1

C:\Users\user\AppData\Roaming\GamePall\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	765853
Entropy (8bit):	5.17061834928747
Encrypted:	false
SSDEEP:
MD5:	3FED15E64BEAFBA75DE61B08A45AE106
SHA1:	E24953271D8C0254AD011D3A65B2C2FA57903681
SHA-256:	B6E250C3F4FBAC3AF5FB8BB1C61CACAD8685D7F2A97063DE23BC22E91B7F2E27
SHA-512:	3948D080135AFEB240815D43F7B5B8D407BA2830FF701D9B8343F2A72E610827EDAAB643444CDCEB86812ADFC9FB3FBA3AAD6DB7488843C2A04E92A3E63FE40D
Malicious:	false
Reputation:	unknown
Preview:	........1$..e.X...h.`...i.h...j.t...k.....l.....n.....o.....p.....q.....r.....s.....t.....v.....w.....y.....z.....\|.....}.#.....+.....0.....8.....@.....H.....O.....V.....].....^....._.....d.....\|.............................n.....................................................).....^.......................<...........G.................J.................9...........E.................~...........{...........\...........L.....k.......................,.................9.....e.....C.......................>...................................8.....Z...........C.................;.................-...........L.................N.................1...........-.....y.........................................s............................p........... .......................i...........).....J.......................L...........M ..... ..... ....Y!.....!....4"....Z"....,#.....#....&$....W$....'%.....%....^&.....&....f'.....(.....(.....(.....)....3..............]+.....+.....,....F,.....,....z-.....-

C:\Users\user\AppData\Roaming\GamePall\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	609259
Entropy (8bit):	5.796202390024141
Encrypted:	false
SSDEEP:
MD5:	CD741C24AF7597E0DC11069D3AC324E0
SHA1:	2A883DFBCF48D5093D70D4B77BBFFFA521287334
SHA-256:	13E982DC4B2B1AEE093E96BA27E02258C2B815CBB062006A4396BB3A3E6A84B1
SHA-512:	6D27998E25B57FF0CE08C3590B69031038CBA390E68333A83514022B2C56B689AF8AD9715302824027864B5320852E9AB77D74E3B8A90DC66DF59F48CEB528C9
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.....h.....i.....j.....k.....l.....n.....o.....p.....q.....r....s.;...t.D...v.Y...w.f...y.l...z.{...\|.....}...........................................................................................;.......................-...........A.................[...........O.....u...........v.................6.......................+.......................}...........G.....y.....9...........K.....y.............................z...........?.....V...................................T.................X.......................r...................................9.....J...........H.......................}.................'.......................<.......................O.............................Z................._..................................)........... .....V.....v.......................j...........N.................3...................................O.....v................./.....C.......................@...........) ....^ ....w ..... ....J!....}!.....!..../".....".....#....8#

C:\Users\user\AppData\Roaming\GamePall\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	441207
Entropy (8bit):	6.685712707138377
Encrypted:	false
SSDEEP:
MD5:	99E6ACFB46923C4F8B29058E9EE6166B
SHA1:	AF06C42E5F3578ADBC4F0BD7262DC6775FDD351F
SHA-256:	9D8498875263B19552A982D1850F2F942FF44AF4E323BC5A3A67C34413994D95
SHA-512:	4FDF5186FC2FC68210C2BE91F5B821F0979CA67D6C9B8915C14E7A20D3CE2548EB2660D5F9F398CF6C585A5C0725FA34FD3670F416F7C8A4F009C729BCF02988
Malicious:	false
Reputation:	unknown
Preview:	.........#..e.T...h.\...i.d...j.g...k.v...l.}...m.....o.....p.....q.....r.....s.....t.....v.....w.....\|.....}...............................(.....-.....5.....<.....C.....E.....J.....S....._.....q.................v.................1......................./.......................:.......................>.............................c.......................D.....j................._.......................n.......................T.....}.................@.....o.................V.......................5.....O.....i................."...........x.......................U.......................].......................=.......................".....s.......................L.....u.................g.......................W.....w.................3.....X.....o...........&.....J.....\.................=.....].............................y.......................y...................................N.....`...........,.....d.....y...........).....O.....^.............................\|.......................x.

C:\Users\user\AppData\Roaming\GamePall\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	439630
Entropy (8bit):	6.6906570508767995
Encrypted:	false
SSDEEP:
MD5:	BB7C995F257B9125457381BB01856D72
SHA1:	21C55FF5CBC4F223C23D5A2FBCC9E051DB78A44C
SHA-256:	F2299E03E99B0E9A9CACE3B1C72E6C8C5FE089487CA1C82F2AAF4273B62E37A2
SHA-512:	5247C5DA6F00DF6241500524DDB162041A03649FA0AFCC11AD40E820814958768A2E11CE34E1250FDBF42B2459F8C06B00AE7442B537F0731A62C6724FC8D890
Malicious:	false
Reputation:	unknown
Preview:	.........#,.e.....h.....i.)...j.-...k.<...l.G...n.O...o.T...p.\...q.b...r.n...s.....t.....v.....w.....y.....z.....\|.....}...................................................................%.....4.....C...........3.....q.................+.....T.....`........... .....R.....d.................M.....b.................3.....?.............................g.......................[.......................S.......................;.......................*.......................@.......................F.............................D.....d.....p.................2.....A.............................q.......................T.......................<.............................i.......................f.......................A.....[.....o.................!.............................u.......................^.............................h.......................P.........................................H.......................Z.......................$.....e.....z.................1.....X.....j...........#.

C:\Users\user\AppData\Roaming\GamePall\log4net.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	275968
Entropy (8bit):	5.778490068583466
Encrypted:	false
SSDEEP:
MD5:	7EA1429E71D83A1CCAA0942C4D7F1C41
SHA1:	4CE6ACF4D735354B98F416B3D94D89AF0611E563
SHA-256:	EDEC54DA1901E649588E8CB52B001AB2AEC76ED0430824457A904FCC0ABD4299
SHA-512:	91C90845A12A377B617140B67639CFA71A0648300336D5EDD422AFC362E65C6CCD3A4FF4936D4262B0EAF7BAE2B9624BCD3C7EEC79F7E7CA18ABE1EC62C4C869
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.X...........!.....,..........~K... ...`....... ..............................H.....@.................................$K..W....`...............................I............................................... ............... ..H............text....+... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................`K......H...........<x...............-..P .......................................i.)V.#c....e../.`...V....j>....?.LbrzKV.x.}...........[.f)..dD`..66.61[.z....W^....>F..r...#. ..g...T...P....Ss)ii.a.v.(0.....(1...o2...s....}.......0..7........{....-%~....r...p.{....r9..p(3...(.....(.......(4.............//........{...."..}......{........0..4..........%...(5....-.~....r?..p(....+...}.......,..(6............')........{......{...."..}.......{...."..}....*.0..........

C:\Users\user\AppData\Roaming\GamePall\log4net.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1547797
Entropy (8bit):	4.370092880615517
Encrypted:	false
SSDEEP:
MD5:	32AB4E0A9A82245EE3B474EF811F558F
SHA1:	9F2C4C9EEB5720D765F2321ACD0FF9F8DD11E6A4
SHA-256:	9BBF4D15F8FB11F7D2C032BD920D2A33B2C2CB8EF62E7E023049AF6132F5D6C1
SHA-512:	A0574A170F69F9926C32BAF6119A16A381FEC9E881B304082859EE7CFF463570C78984EE14369C59CDB19E532B3ABF193D02B462F1B40D07214B6244150CD63F
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0"?>..<doc>.. <assembly>.. <name>log4net</name>.. </assembly>.. <members>.. <member name="T:log4net.Appender.AdoNetAppender">.. <summary>.. Appender that logs to a database... </summary>.. <remarks>.. <para>.. <see cref="T:log4net.Appender.AdoNetAppender"/> appends logging events to a table within a.. database. The appender can be configured to specify the connection .. string by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionString"/> property. .. The connection type (provider) can be specified by setting the <see cref="P:log4net.Appender.AdoNetAppender.ConnectionType"/>.. property. For more information on database connection strings for.. your specific database see <a href="http://www.connectionstrings.com/">http://www.connectionstrings.com/</a>... </para>.. <para>.. Record

C:\Users\user\AppData\Roaming\GamePall\natives_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	342741
Entropy (8bit):	5.496697631795104
Encrypted:	false
SSDEEP:
MD5:	A58DB728B50E6B82CBDCAA0DB61D36B1
SHA1:	7CD76526CB29A0FF5350A2B52D48D1886360458B
SHA-256:	BA2F2AC6AE9BC67399728F25772A0EB3E840695395CC747ADF4B2F8B5D6D9A46
SHA-512:	0DB9AFBDADA44364521D89BAB6055458125F4F3C8C1B09048EAFA4055A194231CCFFD82FCDADA9360AB2B19F472B893330EBFCB027391E7A0C2B1100FC51E673
Malicious:	false
Reputation:	unknown
Preview:	..mirrors....(function(a,b){."use strict";.var c=a.Array;.var d=a.isNaN;.var e=a.JSON.stringify;.var f;.var g;.var h=b.ImportNow("promise_state_symbol");.var i=b.ImportNow("promise_result_symbol");.var j;.var k;.b.Import(function(l){.f=l.MapEntries;.g=l.MapIteratorNext;.j=l.SetIteratorNext;.k=l.SetValues;.});.var m={.UNDEFINED_TYPE:'undefined',.NULL_TYPE:'null',.BOOLEAN_TYPE:'boolean',.NUMBER_TYPE:'number',.STRING_TYPE:'string',.SYMBOL_TYPE:'symbol',.OBJECT_TYPE:'object',.FUNCTION_TYPE:'function',.REGEXP_TYPE:'regexp',.ERROR_TYPE:'error',.PROPERTY_TYPE:'property',.INTERNAL_PROPERTY_TYPE:'internalProperty',.FRAME_TYPE:'frame',.SCRIPT_TYPE:'script',.CONTEXT_TYPE:'context',.SCOPE_TYPE:'scope',.PROMISE_TYPE:'promise',.MAP_TYPE:'map',.SET_TYPE:'set',.ITERATOR_TYPE:'iterator',.GENERATOR_TYPE:'generator',.}.var n=0;.var o=-1;.var p=[];.var q=true;.function MirrorCacheIsEmpty(){.return n==0&&p.length==0;.}.function ToggleMirrorCache(r){.q=r;.ClearMirrorCache();.}.function ClearMirrorCache(r){.

C:\Users\user\AppData\Roaming\GamePall\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	8226870
Entropy (8bit):	7.996842728494533
Encrypted:	true
SSDEEP:
MD5:	F7EC58AEA756F3FD8A055AC582103A78
SHA1:	086B63691F5E5375A537E99E062345F56512A22C
SHA-256:	517418184EA974C33FFE67B03732D19B1234DCB9E5C1C2E9E94ED41B3BC1D064
SHA-512:	C620C6E16BBCEE9BC607E6CA75D602C756276AC69E5F3761D82DE7728164133656A71A69043EB1A86CE3051FDE4327A47EFD41D1FF47C8385699CA67C423AD7B
Malicious:	false
Reputation:	unknown
Preview:	............f.6:..{..D..\|..G..~. K.....]....._....=.....c...........9.....B.............................F.....K/.....2....54....r5.....6.....?.....@....jB.....C....hD.....E.....H....nj.....k.....r....@~...."..........W.....................;..../;'...2;P...7;....8;....C;....D;U...E;....F;....G;A,..H;.;..I;gK..J;.Z..K;.h..L;.}..M;y...N;{...O;z...P;....Q;8...R;....S;....T;C'..U;.=..V;.W..W;.m..X;....Y;....Z;D...[;....\;....];.....<.....<x....<.....<-....<\....<.....<.....<.....<.....<*(...< /...<+3...<.3..I=.3..J=.7..K=.9..R= >..S=.G..T=}V..[=;w..\=.x..]=.}..^=R..._=....`=....a=....b=....c=....e=:...f=.....=....=.....=....=`....=p....=.....=.....=.....=.....=.....=K....=.....=t....=.....=.....=.....=\....=Z....=.....=T....=[....=x....=.....=.....=D....=.....=.....=.....=l....=F....=.'...=j)...>.+...>l,...>_0...>.2...>.6...>.8..N>.\..O>~^..P>._..Q>%d..R>.k..S>.l..T>Tn..U>.p..b>.u..c>/y..d>.\|..B@....C@....D@o...E@....F@W...L@Z...M@(...N@...O@....D.....D ....D ....D;....D.....D....D..

C:\Users\user\AppData\Roaming\GamePall\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	276319
Entropy (8bit):	4.242318669799302
Encrypted:	false
SSDEEP:
MD5:	8234983533FA47D2A1D7710FF8274299
SHA1:	E4C5793B6FE6A6C6C9D8E3921B3BC341AE3448D8
SHA-256:	F95553D8066144CBB8A05EED1735C94A4B97A2E44E49F624C2302990A13017C9
SHA-512:	1E7E201B0FF9AFA7821B5FFD0A36548A49CD4DBBABA5858E13DA35058670A5053723DD3544B2FD85C619F2B8FC9E5DB48DF977BB293E7BA7DE6F22CC8DAB28CA
Malicious:	false
Reputation:	unknown
Preview:	.........X./j1N.11.8.172.9.......................................................@...y...........@..`....`....`....`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\start.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.8731406795131327
Encrypted:	false
SSDEEP:
MD5:	2C66F3C2190A84FAFD4449DAF6440EAC
SHA1:	7B9E4C94329FE26C34E63AB8336227FD5EB553E9
SHA-256:	58EB97E30289A3FCAE270DBCC01258A862936350CB0EF781AE76D6A9444C0155
SHA-512:	62713209575426CE503605C6F451E9DFB025BE0295F0A453614862CE390F5987F0E16BAE6B37B4B1A7330A7CB5AA31249F8CF58DE37B8B701C16881E4E4E61C1
Malicious:	false
Reputation:	unknown
Preview:	start GamePall.exe OuWe5kl

C:\Users\user\AppData\Roaming\GamePall\swiftshader\Xilium.CefGlue.pdb

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	MSVC program database ver 7.00, 512*4023 bytes
Category:	dropped
Size (bytes):	2059776
Entropy (8bit):	4.067542396670122
Encrypted:	false
SSDEEP:
MD5:	70F9EAEA8A2A604E59F72EDE66F83AB4
SHA1:	0AB9EA1BFFDFF471EC22AB289C7FBC5E0CDF48BF
SHA-256:	38A07BA75CC2BBDF715CA87D380A4E5A0DCFAF9C30C5ECD30F6107871D51825B
SHA-512:	47DE4DAD93385A4907FADE307040FE026ED66989C0C9915AFC96CB2BC93DE5E106DC1274E4AD2382021C758C60FEDE06D68998CF3591E23E2951778CE09D6D4C
Malicious:	false
Reputation:	unknown
Preview:	Microsoft C/C++ MSF 7.00...DS................J..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346624
Entropy (8bit):	6.54104466243173
Encrypted:	false
SSDEEP:
MD5:	7A53AD3E5D2E65C982450E7B7453DE8A
SHA1:	99F27E54F1F61207C02110CAC476405557A8AD54
SHA-256:	24FDDD6A367792A9D86D9060FC9AA459B5FB0F67804CB7D139A100D86BBDAFF8
SHA-512:	2B5E5DB46FDC787CB46CDAEBFFC01586E248FBB864677B27AF03CDC33E956DEF51B3F836597E7092C4175CF605C44728C6F96B74BB2C9870E9715D4AF4C531A1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.........T............................................................@A....................................P....p...........................3..4.......................8........G...............................................text............................... ..`.rdata..............................@..@.data....4..........................@....00cfg.......@......................@..@.tls.........P......................@....voltbl......`...........................rsrc........p......................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\swiftshader\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2445312
Entropy (8bit):	6.750207745422387
Encrypted:	false
SSDEEP:
MD5:	334C3157E63A34B22CCE25A44A04835F
SHA1:	C6B05BD55BE9FED3B0C5077C5649E2A41C10DC08
SHA-256:	3E307570B574469EC8BCF1CE6D5291DF8D627CA3812F05AACFEBBD3F00B17F89
SHA-512:	11F538ADD05515861891892EBB90163B6540B72FEB380D64B4A0AA56C6415E3B71374557BF50D0B936712B1006F2B94D59BEBFBF18CBF93BB883D9055CAAEEE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......_.........."!.....4 .................................................p*...........@A..........................#.. ....$.d....P)......................`).......#.......................#......."...............$.P............................text.../2 ......4 ................. ..`.rdata..\....P ......8 .............@..@.data...L....@$...... $.............@....00cfg....... )......>$.............@..@.tls.........0)......@$.............@....voltbl.M....@)......B$..................rsrc........P)......D$.............@..@.reloc.......`)......H$.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	631017
Entropy (8bit):	5.144793130466209
Encrypted:	false
SSDEEP:
MD5:	0794DF29DF8DFC3ECE5C443F864F5AEB
SHA1:	BFD4A9A34BEB9751BC4203FB9A9172F1F05E5B16
SHA-256:	3EE2237E9B14871165B051CCF892C8375E45B5F12841E02F4B9D37F5D5A03283
SHA-512:	0D34E36F7455B977F086F04840FBA679284A619A7164A56B5C7FC2ADCB23A231B67A62101540EB07CF5C8192790266B08D2CC232D291621C331FE77C1F5E52C0
Malicious:	false
Reputation:	unknown
Preview:	..........d..<..11.8.172.9......................................................@...]!...S..y...-[..........`....`....`T...`b...`....`............B..............b........."..............B..............b...(Jb...)L.....@..F^.1..5.`.....(Jb...-P.....@..F^..`.....H...IDa........Db............D`.....-.D`.....D]D....D`......WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa...........WIa............L...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4400640
Entropy (8bit):	6.667314807988382
Encrypted:	false
SSDEEP:
MD5:	7F913E31D00082338F073EF60D67B335
SHA1:	AC831B45F2A32E23BA9046044508E47E04CDA3A4
SHA-256:	B60E9818C4EA9396D0D2D2A4AC79C7DC40D0DFF6BB8BC734D0AB14ADC30FBF30
SHA-512:	E1AC79C775CF9137283CD2C1AE1A45EC597E0351CDB9C11D483E2E1F8B00CC2BBC5807A50DED13A3A5E76F06C1A565EFF1233F4EC727B0C5F7AA3BEAEA906750
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....$5.........P.-......................................PD...........@A........................8=?.~....\?.P.... B......................0B.X.....?.....................H.?......@5.............._?..............................text...T#5......$5................. ..`.rdata...a...@5..b...(5.............@..@.data...@N....?..x....?.............@....00cfg........B.......A.............@..@.tls....5.....B.......A.............@....rsrc........ B.......A.............@..@.reloc..X....0B.......A.............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Reputation:	unknown
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Roaming\GamePall\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	826368
Entropy (8bit):	6.78646032943732
Encrypted:	false
SSDEEP:
MD5:	A031EB19C61942A26EF74500AD4B42DF
SHA1:	FDC6EA473234F153639E963E8EFB8D028DA1BE20
SHA-256:	207706A3A3FAA8500F88CB034B26413074EFC67221A07C5F70558F3C40985A91
SHA-512:	80F843E47FC2B41B17EF6EA1BB2BB04119B2417311599EC52120D9F9DF316B4D7B1DAF97EE5CDF2AE78CDB9475E5C65255A7F2AB2A9231804F6A82C83303FD19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....e.........."!.....\|..........@.....................................................@A...........................<!..$...P....p..............................l..............................................P................................text....z.......\|.................. ..`.rdata..tr.......t..................@..@.data....7..........................@....00cfg.......P......................@..@.tls.........`......................@....rsrc........p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\GamePall\widevinecdmadapter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.566524833521835
Encrypted:	false
SSDEEP:
MD5:	6D7FD214164C858BBCF4AA050C114E8C
SHA1:	B8868DA6BB9A79EE7C9901A9BFAC580D5BAFCC96
SHA-256:	3F58FB22BD1A1159C351D125BEE122A16BB97BABB5FCA67FDBD9AAAED3B302E6
SHA-512:	0F8F2523C3A616AC7C72A1239B7E353F6A684FF75DA79D1CAF9B98A47FF6FE06329165825704C67C04E92073BA2C17D0FF339C57731DDF0F1489C2E97D1D0A14
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............^...^...^..._...^..._q..^..._..^..._..^..._..^..._..^k.._...^..._...^...^...^k.._...^k.._...^n..^...^k.._...^Rich...^........................PE..L...Ua.X.........."!.........(......c........0............................................@.................................x...<....@.......................P..T"......8...............................@............0..0............................text............................... ..`.rdata..`....0....... ..............@..@.data...............................@....gfids.......0......................@..@.rsrc........@......................@..@.reloc..T"...P...$..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wdugfia

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	284672
Entropy (8bit):	5.557084591006534
Encrypted:	false
SSDEEP:
MD5:	5F93B2E5FAF3721C176353FD8AB82F9D
SHA1:	85B6C685A5A88E8E25385A73330DEFA2A3C9F373
SHA-256:	7FC4847438A3867AB9380525626D0CECE5F31BD4D148864E4168616C182F7B6E
SHA-512:	1AB0AE7EFF5A0E0D588E6D85BB31C47B5E7E064842599CFEE58E065CEDDB0C1864965C6C4662174521778B56D4E266CE8252D4B6373B81858E32481CB9ADF426
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{...}..}..}..}..}..}...}..}...}.An}..}..}...}..}..}..}..}..}..}Rich..}........................PE..L...8..d............................P.............@.........................................................................,_..x....0..8............................................................................................................text...`........................... ..`.rdata..f...........................@..@.data... ....p.......Z..............@....rsrc...8....0.......x..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wdugfia:Zone.Identifier

Download File

Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2419838832995858
Encrypted:	false
SSDEEP:
MD5:	24A7B3DFDE10C68E8534638E8C10D357
SHA1:	8CF5D31253BE9E2DF467347E7C8B8A1AA6E54A71
SHA-256:	E03458CC8914BA6E6FFAB5F3F6BF41A64EF57EDC1F04FB6080F453DADF55302A
SHA-512:	CCC9A7722CE6D65F4FFD7EF8210D0264F4E8FA6C4CAB653200EBD349E074B8476CBE15F5C46E342D9D03EDEE9D97A41769CFAC1C7DA51FBD07DCE2DF224CF140
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. W.e.d. .. O.c.t. .. 0.4. .. 2.0.2.3. .1.2.:.0.3.:.4.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.557084591006534
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% InstallShield setup (43055/19) 0.43% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	5GOuTtZoQn.exe
File size:	284'672 bytes
MD5:	5f93b2e5faf3721c176353fd8ab82f9d
SHA1:	85b6c685a5a88e8e25385a73330defa2a3c9f373
SHA256:	7fc4847438a3867ab9380525626d0cece5f31bd4d148864e4168616c182f7b6e
SHA512:	1ab0ae7eff5a0e0d588e6d85bb31c47b5e7e064842599cfee58e065ceddb0c1864965c6c4662174521778b56d4e266ce8252d4b6373b81858e32481cb9adf426
SSDEEP:	3072:Qs5CLMAaLn4fiRoDThD9A/cDIAGCjoZ/y5G1+ZtQXGumXvH/ddkxrj:PQLMAajfY9McDnZMZ/QZtQyXvarj
TLSH:	8C54E59375F1A815E2A34B305F3BA6EC3B3F78B26D20437A61102E1A5B756A1E943713
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........{....}...}...}...}...}...}...}...}...}.An}...}...}...}...}...}...}...}...}...}Rich...}........................PE..L...8..d...

File Icon


Icon Hash:	1723352529170717

Static PE Info

General

Entrypoint:	0x401a50
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64A3A938 [Tue Jul 4 05:08:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9ab579f0940038199ed136d401eb2211

Entrypoint Preview

Instruction
call 00007F4924C7EBE0h
jmp 00007F4924C79FFEh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [004288F8h], eax
mov dword ptr [004288F4h], ecx
mov dword ptr [004288F0h], edx
mov dword ptr [004288ECh], ebx
mov dword ptr [004288E8h], esi
mov dword ptr [004288E4h], edi
mov word ptr [00428910h], ss
mov word ptr [00428904h], cs
mov word ptr [004288E0h], ds
mov word ptr [004288DCh], es
mov word ptr [004288D8h], fs
mov word ptr [004288D4h], gs
pushfd
pop dword ptr [00428908h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [004288FCh], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [00428900h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0042890Ch], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [00428848h], 00010001h
mov eax, dword ptr [00428900h]
mov dword ptr [004287FCh], eax
mov dword ptr [004287F0h], C0000409h
mov dword ptr [004287F4h], 00000001h
mov eax, dword ptr [00427004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [00427008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000B8h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25f2c	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1f43000	0x1de38	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb000	0x198	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9b60	0x9c00	934d4e185905da48b84b8744c6dd9ddb	False	0.6057942708333334	data	6.596345799435614	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xb000	0x1b866	0x1ba00	b069e4803fd63b6d1c0904142f5fb1f9	False	0.5057533229638009	OpenPGP Public Key Version 2	5.1495284540279025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x1f1bc20	0x1e00	e3e20201ba23540af55e3b37cb756963	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1f43000	0x1de38	0x1e000	8fe2c2c1e12ce75c44aacc30cee1edda	False	0.45990397135416666	data	5.197860086566417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x1f5a560	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4276315789473684
RT_ICON	0x1f43af0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Turkish	Turkey	0.6066098081023454
RT_ICON	0x1f44998	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Turkish	Turkey	0.6872743682310469
RT_ICON	0x1f45240	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Turkish	Turkey	0.7419354838709677
RT_ICON	0x1f45908	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Turkish	Turkey	0.7890173410404624
RT_ICON	0x1f45e70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Turkish	Turkey	0.5868257261410789
RT_ICON	0x1f48418	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Turkish	Turkey	0.7152908067542214
RT_ICON	0x1f494c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	Turkish	Turkey	0.7241803278688524
RT_ICON	0x1f49e48	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Turkish	Turkey	0.8687943262411347
RT_ICON	0x1f4a328	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.3736673773987207
RT_ICON	0x1f4b1d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.47382671480144406
RT_ICON	0x1f4ba78	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.5149769585253456
RT_ICON	0x1f4c140	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.5361271676300579
RT_ICON	0x1f4c6a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.399792531120332
RT_ICON	0x1f4ec50	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.41322701688555347
RT_ICON	0x1f4fcf8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.4618852459016393
RT_ICON	0x1f50680	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.4716312056737589
RT_ICON	0x1f50b60	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.28171641791044777
RT_ICON	0x1f51a08	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.427797833935018
RT_ICON	0x1f522b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.5558755760368663
RT_ICON	0x1f52978	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.5802023121387283
RT_ICON	0x1f52ee0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.1817427385892116
RT_ICON	0x1f55488	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.27909836065573773
RT_ICON	0x1f55e10	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.2828014184397163
RT_ICON	0x1f562e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.4157782515991471
RT_ICON	0x1f57188	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5839350180505415
RT_ICON	0x1f57a30	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6296082949308756
RT_ICON	0x1f580f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6206647398843931
RT_ICON	0x1f58660	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.5039868667917449
RT_ICON	0x1f59708	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.48565573770491804
RT_ICON	0x1f5a090	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.526595744680851
RT_STRING	0x1f5a850	0x84	data			0.6439393939393939
RT_STRING	0x1f5a8d8	0x84	data			0.5909090909090909
RT_STRING	0x1f5a960	0x796	data			0.42687950566426364
RT_STRING	0x1f5b0f8	0x6f8	data			0.42937219730941706
RT_STRING	0x1f5b7f0	0x686	data			0.42574850299401196
RT_STRING	0x1f5be78	0x1a6	data			0.5284360189573459
RT_STRING	0x1f5c020	0x7fc	data			0.41682974559686886
RT_STRING	0x1f5c820	0x774	data			0.42348008385744235
RT_STRING	0x1f5cf98	0x7cc	data			0.4243486973947896
RT_STRING	0x1f5d768	0x4c2	data			0.45977011494252873
RT_STRING	0x1f5dc30	0x788	data			0.4279045643153527
RT_STRING	0x1f5e3b8	0x5b4	data			0.4452054794520548
RT_STRING	0x1f5e970	0x72e	data			0.42709466811751906
RT_STRING	0x1f5f0a0	0x650	data			0.43316831683168316
RT_STRING	0x1f5f6f0	0x7f4	data			0.4179764243614931
RT_STRING	0x1f5fee8	0x720	data			0.42653508771929827
RT_STRING	0x1f60608	0x7c4	data			0.42505030181086517
RT_STRING	0x1f60dd0	0x62	data			0.6632653061224489
RT_GROUP_CURSOR	0x1f5a690	0x14	data			1.15
RT_GROUP_ICON	0x1f50ae8	0x76	data	Turkish	Turkey	0.6694915254237288
RT_GROUP_ICON	0x1f56278	0x68	data	Turkish	Turkey	0.7115384615384616
RT_GROUP_ICON	0x1f4a2b0	0x76	data	Turkish	Turkey	0.6610169491525424
RT_GROUP_ICON	0x1f5a4f8	0x68	data	Turkish	Turkey	0.7211538461538461
RT_VERSION	0x1f5a6a8	0x1a8	data			0.5943396226415094

Imports

DLL	Import
KERNEL32.dll	SetVolumeMountPointW, GetComputerNameW, SetCommBreak, SleepEx, GetCommProperties, GetModuleHandleW, GetTickCount, EnumCalendarInfoExW, GlobalAlloc, GetConsoleAliasExesLengthW, WriteConsoleOutputA, lstrcpynW, GetModuleFileNameW, GetConsoleAliasesW, CreateJobObjectW, GetProcAddress, LoadLibraryA, WriteConsoleA, UnhandledExceptionFilter, InterlockedExchangeAdd, LocalAlloc, AddAtomW, AddAtomA, FoldStringA, lstrcatW, GetConsoleTitleW, BuildCommDCBA, FindFirstVolumeW, AreFileApisANSI, ZombifyActCtx, GetLogicalDriveStringsW, GetLastError, OpenJobObjectA, CreateFileA, WriteConsoleW, MultiByteToWideChar, HeapAlloc, HeapReAlloc, GetStartupInfoW, TerminateProcess, GetCurrentProcess, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCPInfo, InterlockedIncrement, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, HeapFree, VirtualFree, VirtualAlloc, HeapCreate, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, SetHandleCount, GetFileType, GetStartupInfoA, HeapSize, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, WideCharToMultiByte, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, InitializeCriticalSectionAndSpinCount, RtlUnwind, ReadFile, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetFilePointer, SetStdHandle, CloseHandle, GetConsoleOutputCP
GDI32.dll	GetCharWidth32W
ADVAPI32.dll	EnumDependentServicesW
ole32.dll	CoTaskMemAlloc
WINHTTP.dll	WinHttpAddRequestHeaders

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Target ID:	0
Start time:	07:27:02
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\5GOuTtZoQn.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5GOuTtZoQn.exe"
Imagebase:	0x400000
File size:	284'672 bytes
MD5 hash:	5F93B2E5FAF3721C176353FD8AB82F9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1854520815.0000000002500000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000000.00000002.1854573605.0000000002541000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1854648292.00000000025B1000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:27:14
Start date:	03/07/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	07:27:26
Start date:	03/07/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff70d820000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:27:26
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:27:33
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\wdugfia
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wdugfia
Imagebase:	0x400000
File size:	284'672 bytes
MD5 hash:	5F93B2E5FAF3721C176353FD8AB82F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000005.00000002.2153839501.0000000003F90000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2153894558.0000000003FA0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000005.00000002.2153984228.0000000003FE1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.2153686108.0000000002471000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:27:47
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Local\Temp\E636.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\E636.exe
Imagebase:	0x7a0000
File size:	6'642'176 bytes
MD5 hash:	BD2EAC64CBDED877608468D86786594A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2234378949.000000000175F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2223257274.000000000175F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2236092761.000000000175F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2234378949.00000000016FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2264120478.0000000001701000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2212422021.000000000175F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2235294827.0000000001700000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2264560521.0000000001706000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2232951408.000000000175F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2236092761.0000000001700000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2235294827.000000000175F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2247835335.0000000001700000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000003.2247835335.000000000175F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:27:56
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Local\Temp\AD6.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\AD6.exe
Imagebase:	0x400000
File size:	293'869 bytes
MD5 hash:	60172CA946DE57C3529E9F05CC502870
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 21%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	07:28:02
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Local\Temp\2DF0.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2DF0.exe
Imagebase:	0xb00000
File size:	578'048 bytes
MD5 hash:	DA4B6F39FC024D2383D4BFE7F67F1EE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000009.00000002.2987292224.000000000126C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:29:18
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Local\Temp\setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\setup.exe"
Imagebase:	0x400000
File size:	107'232'830 bytes
MD5 hash:	FF2293FBFF53F4BD2BFF91780FABFD60
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:29:47
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Imagebase:	0x860000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:29:54
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=gpu-process --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3308 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2
Imagebase:	0x470000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:29:54
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3528 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0x300000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:29:54
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --mojo-platform-channel-handle=3664 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8
Imagebase:	0x830000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:29:54
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --first-renderer-process --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077579277 --mojo-platform-channel-handle=3760 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0xce0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:29:54
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe" --type=renderer --log-severity=disable --user-agent="Mozilla/5.0 (iPhone; CPU iPhone OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/127.1 Mobile/15E148 Safari/605.1.15" --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --no-sandbox --log-file="C:\Users\user\AppData\Roaming\GamePall\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1719999716977116 --launch-time-ticks=7077667358 --mojo-platform-channel-handle=4152 --field-trial-handle=3304,i,784606554325148639,9845247229423355752,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:1
Imagebase:	0x10000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:29:54
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xa50000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	07:29:55
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x840000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:29:56
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x8a0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:29:56
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x310000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:29:59
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x870000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	07:29:59
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc50000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	07:29:59
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x750000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:30:00
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x960000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	07:30:00
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x70000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	07:30:00
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xb10000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	07:30:01
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xa90000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	07:30:02
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xc60000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	07:30:02
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\wdugfia
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wdugfia
Imagebase:	0x400000
File size:	284'672 bytes
MD5 hash:	5F93B2E5FAF3721C176353FD8AB82F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	07:30:02
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x170000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	07:30:03
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x450000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	07:30:04
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xd30000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	07:30:04
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xf90000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	07:30:05
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x300000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	07:30:06
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x610000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	07:30:07
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x960000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	07:30:07
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0xf60000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	07:30:07
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\GamePall\GamePall.exe"
Imagebase:	0x9e0000
File size:	296'448 bytes
MD5 hash:	7A3502C1119795D35569535DE243B6FE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	39.2%
Signature Coverage:	48%
Total number of Nodes:	125
Total number of Limit Nodes:	2

Executed Functions

Function 004015E9 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c403c01a180556a21b32c54d606707ce257114ba21ce773171317465317b1327
Instruction ID: 81f6fda8427d1b43236a49491d64036918e053862e587f83ca4f6c41e111eef5
Opcode Fuzzy Hash: c403c01a180556a21b32c54d606707ce257114ba21ce773171317465317b1327
Instruction Fuzzy Hash: AC615EB0504245FBEB208F95CC89FAF7BB8EF85B04F14012AF912BA1E4D7759901DB69

Function 00401619 Relevance: 10.7, APIs: 7, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3d4281f98edc4d5c9fab7c34e02c6c853fffeeebf89f5f13e04729d870c637b5
Instruction ID: 34f674698f60fb638750c99b36bb87cf40fbeb55ae16eb5ab1a87acb7576c899
Opcode Fuzzy Hash: 3d4281f98edc4d5c9fab7c34e02c6c853fffeeebf89f5f13e04729d870c637b5
Instruction Fuzzy Hash: 5A512AB1900245AFEB208F91CC88FEF7BB8FF85B14F104169F911BA2A5D7709905CB64

Function 00401603 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4186ed6ca559843089d86802de6bf93cc630300b35f8a7e227ae1c2dabc27439
Instruction ID: 500dda8f23b5602c1307b1711735e417e9b6475dbe97846f9c47cbefd4493b2b
Opcode Fuzzy Hash: 4186ed6ca559843089d86802de6bf93cc630300b35f8a7e227ae1c2dabc27439
Instruction Fuzzy Hash: 5D510BB4900245BBEB208F91CC88FAF7BB8FF85B10F14016AF911BA2E5D7759945CB64

Function 004015F4 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8de2cd78c693d786da25ad92aa3590499b5e06c5f1034c6ee7cdd7a8a44e8d5
Instruction ID: 8b638c4f7f3c0f26ddcfcec7b057d6f6967c7c5477f34391eb5885aa1730f63c
Opcode Fuzzy Hash: d8de2cd78c693d786da25ad92aa3590499b5e06c5f1034c6ee7cdd7a8a44e8d5
Instruction Fuzzy Hash: CA510BB4900245BBEB208F91CC88FAF7BB8FF85B10F14016AF911BA2E5D7759945CB64

Function 00401609 Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3459b8fafdf8a8df719c8fb692eff12af857f3ad78a1142d35235e32c4799eaf
Instruction ID: 8a1e2b8333ad6a574571ef74a267b756117d0849135357e0b61be7edc131f59a
Opcode Fuzzy Hash: 3459b8fafdf8a8df719c8fb692eff12af857f3ad78a1142d35235e32c4799eaf
Instruction Fuzzy Hash: 3C512AB4900245BBEB208F91CC88FAF7BB8FF85B10F100129F911BA2A5D7759945CB64

Function 00401632 Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 73eedc29cdf7be90d3b565f1e242fa5b34b97ee6546eaec91e452f80b0ccb5af
Instruction ID: e56c67f9e8f5edeb92f1a0f588b2a2b834a4b3448f2afe8c32594d36a8ed9c60
Opcode Fuzzy Hash: 73eedc29cdf7be90d3b565f1e242fa5b34b97ee6546eaec91e452f80b0ccb5af
Instruction Fuzzy Hash: 9151F8B5900249BFEB208F91CC88FDFBBB8FF85B14F100159BA11BA2A5D7709945CB24

Function 004030C5 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004031F9
NtTerminateProcess.NTDLL ref: 00403212

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 312986233a1ab2372f57b14058cfc035e9d9fe77e3ddd66eb4c0ae072f0c4bc6
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: EB413631218E084FD768EF6CA84976277D5F798311F6643AAE809D7389EA34DC1183C5

Function 025B49F2 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025B4A1A
Module32First.KERNEL32(00000000,00000224), ref: 025B4A3A

Memory Dump Source

Source File: 00000000.00000002.1854648292.00000000025B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 025B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25b1000_5GOuTtZoQn.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: ff51bc355daaed38aff3025370ec17f14f34f22b59a57a1fc5e52c36da3110d1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 06F0F6365003106BD7313BF8A89CBEE7AEDBF4A624F100128E642D14C1DB70E8058A69

Function 00403222 Relevance: 3.0, APIs: 2, Instructions: 37
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004031F9
NtTerminateProcess.NTDLL ref: 00403212

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 5d7857a4a428113aea85439a71c383134f8f036b8fb53e8d04ea105b502fc76d
Instruction ID: 7a3a570a7e2b6e2e57b365b8c386a87b2fd15f69fabf49474fc32827e03357c3
Opcode Fuzzy Hash: 5d7857a4a428113aea85439a71c383134f8f036b8fb53e8d04ea105b502fc76d
Instruction Fuzzy Hash: B8E09B3191494909E224E6A964423E4BB80F789236F6411EBD565D12C1E55F879782C6

Function 004017F7 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 85651f3789586eff84ea568efb8665d13f3d48c2f286855f18274e3928cd8560
Instruction ID: d3ccb124cda5ba7a4bea3d036a5926c00f28a27dd7edc6978ea291a301fd4f8b
Opcode Fuzzy Hash: 85651f3789586eff84ea568efb8665d13f3d48c2f286855f18274e3928cd8560
Instruction Fuzzy Hash: 0EE02232504180AFEB248F70C88AEAA7FB0FF61308708026CE09054261D3364911CF58

Function 024F003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 024F024D

Strings

cess, xrefs: 024F018D
kernel32.dll, xrefs: 024F008F, 024F0095

Memory Dump Source

Source File: 00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_5GOuTtZoQn.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fbf06393b412c87a3d50d88f0dbf1f48102c0f1d04f45ddb18649da5986a0ba6
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 3E526D74A01229DFDBA4CF58C984BADBBB1BF49304F1480DAE54DA7356DB30AA85CF14

Function 024F0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,024F0223,?,?), ref: 024F0E19
SetErrorMode.KERNELBASE(00000000,?,?,024F0223,?,?), ref: 024F0E1E

Memory Dump Source

Source File: 00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_5GOuTtZoQn.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a1355340812a76edfb87e8f37077e87cd166259ba3829630d5b4c7a92252a5d3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 52D01231545128B7D7402A94DC09BCE7B1CDF45B66F008011FB0DD9181C770954046E5

Function 004019BD Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Part of subcall function 004015E9: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
Part of subcall function 004015E9: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 002abf4147cc44dd106f2b9821ac185759d600f3530b55a8e676946b78b131f3
Instruction ID: e2974f241766d04c7081462d4ca2abe6b5e4a304a4234f5a91902124bd20d52f
Opcode Fuzzy Hash: 002abf4147cc44dd106f2b9821ac185759d600f3530b55a8e676946b78b131f3
Instruction Fuzzy Hash: BC118EB134D204EBEB00AAD48D82E6B3658AB01754F30817BB607791F0D57D9A13FB6B

Function 004019C8 Relevance: 1.3, APIs: 1, Instructions: 61
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2344a0ec476235cd0ca625371c038d14233a4536a073d2e832153e82ec7f32c1
Instruction ID: 9a362fc77340605c6e6f4b0bc9a5ecd872e53382ec3836953d58f0e25d3c226f
Opcode Fuzzy Hash: 2344a0ec476235cd0ca625371c038d14233a4536a073d2e832153e82ec7f32c1
Instruction Fuzzy Hash: 1311917670D241EBDB019AA08C81AAA37649F41300F2482BBF553791F1C53DDA13EB2B

Function 004019EC Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Part of subcall function 004015E9: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
Part of subcall function 004015E9: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2d2a83572eca032da882ada7310456c8301e4701373321586ea13456b050a144
Instruction ID: c75f0512fb6ac4c74365e36f38d693f082cd7c070fee16f1fd5a87275f204c49
Opcode Fuzzy Hash: 2d2a83572eca032da882ada7310456c8301e4701373321586ea13456b050a144
Instruction Fuzzy Hash: 1201717134E105EBDB009AD08D41A6A32199B45700F20817BB607781F1D67D8A12BB2B

Function 025B46B1 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025B4702

Memory Dump Source

Source File: 00000000.00000002.1854648292.00000000025B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 025B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25b1000_5GOuTtZoQn.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 77ec6f6ce5457ade0f59774b8eb06876dad3e0f6320a3c366664fbb038bb9c6b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 47112B79A00208EFDB01DF98C985E98BBF5AF08350F058094F9489B362D371EA50DF84

Function 004019F2 Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Part of subcall function 004015E9: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
Part of subcall function 004015E9: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 9a88e1a388e7f99f6910d9958252f34bb3826b2cbe02ae65f90951c14fd9a552
Instruction ID: 0011880760dd260d211533c0e83e0a01d9c02e15723a0a2af455ba8ff62ae6bc
Opcode Fuzzy Hash: 9a88e1a388e7f99f6910d9958252f34bb3826b2cbe02ae65f90951c14fd9a552
Instruction Fuzzy Hash: 0501623170A205EBDB01ABE49D81EAA37249F05314F204177F503B91F1D67DDA12AF2B

Non-executed Functions

Function 024F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 024F095F
GetProcAddress., xrefs: 024F09DC, 024F09DF, 024F09E4
l, xrefs: 024F0966

Memory Dump Source

Source File: 00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_5GOuTtZoQn.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 8cc2ddee45e4730f41419645bc1fe682aa102da875142fd5a7aad30607f3018e
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 41318AB6900609CFEB10CF99C880AAEBBF9FF88324F14504AD941A7315D771EA45CFA4

Function 004033A5 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a11b8886bc5a55e849dc168c8d66a6580bbcc78fabc53793da1861fc1c4968ee
Instruction ID: 99c089e88d752ae15f559b7cde6d10c402be0283320b8487bac010586060de21
Opcode Fuzzy Hash: a11b8886bc5a55e849dc168c8d66a6580bbcc78fabc53793da1861fc1c4968ee
Instruction Fuzzy Hash: 8D31585281D3C09FD3230F6058A5A667F6C5613306B2A50FBC442BE1E3DA7D9B0AA35F

Function 004033F5 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e18d58ef7e6616fddb39b591598bb7d969d3885357e8c02b9f80a7a807497c8
Instruction ID: 6da59bd9ec2d75c3407da3a441f7425016dcea827cdc246f40788caf55ae57aa
Opcode Fuzzy Hash: 0e18d58ef7e6616fddb39b591598bb7d969d3885357e8c02b9f80a7a807497c8
Instruction Fuzzy Hash: 4A113D6291C681CBD7174F1158E8A367F2C5602307B2640BBC902B91E2DF7D5B06634F

Function 00403385 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7e4b5894b2c6eecd6f073f6f8a263570923473a922455e0a074f2af0b9407f9
Instruction ID: 3664ed7273788c7049171d09a9420e0c20c723c297bc8062d4273d8a0c982441
Opcode Fuzzy Hash: c7e4b5894b2c6eecd6f073f6f8a263570923473a922455e0a074f2af0b9407f9
Instruction Fuzzy Hash: 9E11266291C681DBC6174F1158E8D367F2C550230772A40BBC902BE1E2EFBD9B06635F

Function 00403399 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fca3ca164cecd6382c334f3ac805b374a46c3377f8cc86c62c4f23ba0aa73a6
Instruction ID: 23eecc910c6b557d22748eda4846e4f8179e2721fff651a63b55ac8a5b0a48bd
Opcode Fuzzy Hash: 9fca3ca164cecd6382c334f3ac805b374a46c3377f8cc86c62c4f23ba0aa73a6
Instruction Fuzzy Hash: FE117BA3D192C19FCB134F245C94A727F289603317B2940B7C442BE1E3DB799A05931F

Function 0040338F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 159ab245548f765065f62b44fd7e1c4dd2635a3a006db3667d526041fef4a1c5
Instruction ID: cc8bf470d196836ea5a1056713303afca826b2c8dc86ab51657535c19d42c99a
Opcode Fuzzy Hash: 159ab245548f765065f62b44fd7e1c4dd2635a3a006db3667d526041fef4a1c5
Instruction Fuzzy Hash: 22110862A1C6819BC6174F1158A89367F2C650230772A44B7C902BA1E3EF7D9B06A35F

Function 025B42CF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854648292.00000000025B1000.00000040.00000020.00020000.00000000.sdmp, Offset: 025B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_25b1000_5GOuTtZoQn.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 226868b026548e60c0ae38d1a188f8ca25ef3339b76c88a880d1195db10634e3
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 5F118E72750100AFDB54DF59EC90EE673EAFF88220B2D8065ED04CB316E676E841CB64

Function 004033D2 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81465c2e053d0df7625a4268410182b68f3757459cdd3492db1ba17ff45c6bf
Instruction ID: cecadfa70a3b5cbcd7e93f6d8df52c98189fd8657a036c1cfd11edb2033b5d6e
Opcode Fuzzy Hash: f81465c2e053d0df7625a4268410182b68f3757459cdd3492db1ba17ff45c6bf
Instruction Fuzzy Hash: 9E012663E096818BCB234F2458A89767F286603317B1A40B7C441BE1E3EB788B05934F

Function 004033D9 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29c611fd808a40f9dff1667aef221487ba70163d36ddfac642116bca70176d5d
Instruction ID: fc70c4b823dace7e3ef632697d60387faff523b36fff4b48334137601d29e84b
Opcode Fuzzy Hash: 29c611fd808a40f9dff1667aef221487ba70163d36ddfac642116bca70176d5d
Instruction Fuzzy Hash: 2F012463E096C14FCB235F244868A76BF286903216B1A80F7C001BF1F3EB798E05924E

Function 004033DF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1853556724.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_5GOuTtZoQn.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e80c51545b8c056cfba435e638bb1a0d6880000a956852ad301e59cb8a1bc8
Instruction ID: 44cc76dee77400e2aad71495faf7c9ac1cddaeadd86670ba27cad0a20c60bee6
Opcode Fuzzy Hash: 41e80c51545b8c056cfba435e638bb1a0d6880000a956852ad301e59cb8a1bc8
Instruction Fuzzy Hash: 7D014763E496C14FCB234F254868A767F286903246B0A80F7C041BE1F3EB788E09934E

Function 024F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1854500732.00000000024F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 024F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_24f0000_5GOuTtZoQn.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: a1c71ae27c6bec535a0940fb186207137ad1d37a2fc915d52da6caf67d1247ae
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 0D01F273A116008FDF61CF20C904BAB33E9FBC6206F0550A6DA0A9738AE370A8418B80

Analysis Process: wdugfiaPID: 6164, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.3%
Dynamic/Decrypted Code Coverage:	39.2%
Signature Coverage:	0%
Total number of Nodes:	125
Total number of Limit Nodes:	2

Executed Functions

Function 004015E9 Relevance: 10.7, APIs: 7, Instructions: 205
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: c403c01a180556a21b32c54d606707ce257114ba21ce773171317465317b1327
Instruction ID: 81f6fda8427d1b43236a49491d64036918e053862e587f83ca4f6c41e111eef5
Opcode Fuzzy Hash: c403c01a180556a21b32c54d606707ce257114ba21ce773171317465317b1327
Instruction Fuzzy Hash: AC615EB0504245FBEB208F95CC89FAF7BB8EF85B04F14012AF912BA1E4D7759901DB69

Function 00401619 Relevance: 10.7, APIs: 7, Instructions: 179
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3d4281f98edc4d5c9fab7c34e02c6c853fffeeebf89f5f13e04729d870c637b5
Instruction ID: 34f674698f60fb638750c99b36bb87cf40fbeb55ae16eb5ab1a87acb7576c899
Opcode Fuzzy Hash: 3d4281f98edc4d5c9fab7c34e02c6c853fffeeebf89f5f13e04729d870c637b5
Instruction Fuzzy Hash: 5A512AB1900245AFEB208F91CC88FEF7BB8FF85B14F104169F911BA2A5D7709905CB64

Function 00401603 Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 4186ed6ca559843089d86802de6bf93cc630300b35f8a7e227ae1c2dabc27439
Instruction ID: 500dda8f23b5602c1307b1711735e417e9b6475dbe97846f9c47cbefd4493b2b
Opcode Fuzzy Hash: 4186ed6ca559843089d86802de6bf93cc630300b35f8a7e227ae1c2dabc27439
Instruction Fuzzy Hash: 5D510BB4900245BBEB208F91CC88FAF7BB8FF85B10F14016AF911BA2E5D7759945CB64

Function 004015F4 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: d8de2cd78c693d786da25ad92aa3590499b5e06c5f1034c6ee7cdd7a8a44e8d5
Instruction ID: 8b638c4f7f3c0f26ddcfcec7b057d6f6967c7c5477f34391eb5885aa1730f63c
Opcode Fuzzy Hash: d8de2cd78c693d786da25ad92aa3590499b5e06c5f1034c6ee7cdd7a8a44e8d5
Instruction Fuzzy Hash: CA510BB4900245BBEB208F91CC88FAF7BB8FF85B10F14016AF911BA2E5D7759945CB64

Function 00401609 Relevance: 10.7, APIs: 7, Instructions: 170
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 3459b8fafdf8a8df719c8fb692eff12af857f3ad78a1142d35235e32c4799eaf
Instruction ID: 8a1e2b8333ad6a574571ef74a267b756117d0849135357e0b61be7edc131f59a
Opcode Fuzzy Hash: 3459b8fafdf8a8df719c8fb692eff12af857f3ad78a1142d35235e32c4799eaf
Instruction Fuzzy Hash: 3C512AB4900245BBEB208F91CC88FAF7BB8FF85B10F100129F911BA2A5D7759945CB64

Function 00401632 Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004016FB
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401719
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 0040175A
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 0040178B
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 73eedc29cdf7be90d3b565f1e242fa5b34b97ee6546eaec91e452f80b0ccb5af
Instruction ID: e56c67f9e8f5edeb92f1a0f588b2a2b834a4b3448f2afe8c32594d36a8ed9c60
Opcode Fuzzy Hash: 73eedc29cdf7be90d3b565f1e242fa5b34b97ee6546eaec91e452f80b0ccb5af
Instruction Fuzzy Hash: 9151F8B5900249BFEB208F91CC88FDFBBB8FF85B14F100159BA11BA2A5D7709945CB24

Function 004030C5 Relevance: 3.2, APIs: 2, Instructions: 168
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004031F9
NtTerminateProcess.NTDLL ref: 00403212

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction ID: 312986233a1ab2372f57b14058cfc035e9d9fe77e3ddd66eb4c0ae072f0c4bc6
Opcode Fuzzy Hash: 8dd8c1b6c2a2e81b31e5df05537a0a765b57e58f23bcff5050bac5d1a8738f05
Instruction Fuzzy Hash: EB413631218E084FD768EF6CA84976277D5F798311F6643AAE809D7389EA34DC1183C5

Function 00403222 Relevance: 3.0, APIs: 2, Instructions: 37
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCreateUserThread.NTDLL ref: 004031F9
NtTerminateProcess.NTDLL ref: 00403212

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: CreateProcessTerminateThreadUser
String ID:
API String ID: 1921587553-0
Opcode ID: 5d7857a4a428113aea85439a71c383134f8f036b8fb53e8d04ea105b502fc76d
Instruction ID: 7a3a570a7e2b6e2e57b365b8c386a87b2fd15f69fabf49474fc32827e03357c3
Opcode Fuzzy Hash: 5d7857a4a428113aea85439a71c383134f8f036b8fb53e8d04ea105b502fc76d
Instruction Fuzzy Hash: B8E09B3191494909E224E6A964423E4BB80F789236F6411EBD565D12C1E55F879782C6

Function 004017F7 Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017AD

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 85651f3789586eff84ea568efb8665d13f3d48c2f286855f18274e3928cd8560
Instruction ID: d3ccb124cda5ba7a4bea3d036a5926c00f28a27dd7edc6978ea291a301fd4f8b
Opcode Fuzzy Hash: 85651f3789586eff84ea568efb8665d13f3d48c2f286855f18274e3928cd8560
Instruction Fuzzy Hash: 0EE02232504180AFEB248F70C88AEAA7FB0FF61308708026CE09054261D3364911CF58

Function 03F9003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 03F9024D

Strings

cess, xrefs: 03F9018D
kernel32.dll, xrefs: 03F9008F, 03F90095

Memory Dump Source

Source File: 00000005.00000002.2153839501.0000000003F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 03F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3f90000_wdugfia.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 157d6c88b9430ebcbfaced4860059fb82ef658043e6ea51b5aeb2a03448f4ab5
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: D1526B75A01229DFEB64CF58C984BACBBB1BF09314F1480DAE54DAB351DB30AA85CF15

Function 02474652 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0247467A
Module32First.KERNEL32(00000000,00000224), ref: 0247469A

Memory Dump Source

Source File: 00000005.00000002.2153686108.0000000002471000.00000040.00000020.00020000.00000000.sdmp, Offset: 02471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2471000_wdugfia.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: fa540a0419e11516bb0450cc3bdf124d4c3e1cea69d3926909240f517859ed91
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: A4F062356007106BD7202AF5AC8CBBF76FDAF49B25F10052EE666925C0DBB4E8454A61

Function 03F90E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,03F90223,?,?), ref: 03F90E19
SetErrorMode.KERNELBASE(00000000,?,?,03F90223,?,?), ref: 03F90E1E

Memory Dump Source

Source File: 00000005.00000002.2153839501.0000000003F90000.00000040.00001000.00020000.00000000.sdmp, Offset: 03F90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3f90000_wdugfia.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: bcffb5b826030e6476582b58e98d393d8e51696329f6821d8c0e83e3e62363f5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 2CD0123554512977EB003A94DC09BCDBB1CDF05B62F048011FB0DD9080CB74954046E5

Function 004019BD Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Part of subcall function 004015E9: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
Part of subcall function 004015E9: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 002abf4147cc44dd106f2b9821ac185759d600f3530b55a8e676946b78b131f3
Instruction ID: e2974f241766d04c7081462d4ca2abe6b5e4a304a4234f5a91902124bd20d52f
Opcode Fuzzy Hash: 002abf4147cc44dd106f2b9821ac185759d600f3530b55a8e676946b78b131f3
Instruction Fuzzy Hash: BC118EB134D204EBEB00AAD48D82E6B3658AB01754F30817BB607791F0D57D9A13FB6B

Function 004019C8 Relevance: 1.3, APIs: 1, Instructions: 61
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2344a0ec476235cd0ca625371c038d14233a4536a073d2e832153e82ec7f32c1
Instruction ID: 9a362fc77340605c6e6f4b0bc9a5ecd872e53382ec3836953d58f0e25d3c226f
Opcode Fuzzy Hash: 2344a0ec476235cd0ca625371c038d14233a4536a073d2e832153e82ec7f32c1
Instruction Fuzzy Hash: 1311917670D241EBDB019AA08C81AAA37649F41300F2482BBF553791F1C53DDA13EB2B

Function 004019EC Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Part of subcall function 004015E9: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
Part of subcall function 004015E9: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 2d2a83572eca032da882ada7310456c8301e4701373321586ea13456b050a144
Instruction ID: c75f0512fb6ac4c74365e36f38d693f082cd7c070fee16f1fd5a87275f204c49
Opcode Fuzzy Hash: 2d2a83572eca032da882ada7310456c8301e4701373321586ea13456b050a144
Instruction Fuzzy Hash: 1201717134E105EBDB009AD08D41A6A32199B45700F20817BB607781F1D67D8A12BB2B

Function 02474311 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 02474362

Memory Dump Source

Source File: 00000005.00000002.2153686108.0000000002471000.00000040.00000020.00020000.00000000.sdmp, Offset: 02471000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2471000_wdugfia.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 7fa0e6ab7176576259ab9646ada4e2495e6a17cb9b41f6b444fd54112206005e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 34113C79A00208FFDB01DF98C985E99BBF5AF08751F058095F9589B361D371EA50DF80

Function 004019F2 Relevance: 1.3, APIs: 1, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00001388), ref: 00401A0E

Part of subcall function 004015E9: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016AB
Part of subcall function 004015E9: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 004016D8

Memory Dump Source

Source File: 00000005.00000002.2152719871.0000000000400000.00000040.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wdugfia.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 9a88e1a388e7f99f6910d9958252f34bb3826b2cbe02ae65f90951c14fd9a552
Instruction ID: 0011880760dd260d211533c0e83e0a01d9c02e15723a0a2af455ba8ff62ae6bc
Opcode Fuzzy Hash: 9a88e1a388e7f99f6910d9958252f34bb3826b2cbe02ae65f90951c14fd9a552
Instruction Fuzzy Hash: 0501623170A205EBDB01ABE49D81EAA37249F05314F204177F503B91F1D67DDA12AF2B

Analysis Process: 2DF0.exePID: 7024, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	21.8%
Signature Coverage:	7.1%
Total number of Nodes:	1543
Total number of Limit Nodes:	79

Executed Functions

Function 00B05B80 Relevance: 36.0, APIs: 15, Strings: 1, Instructions: 7953COMMON

Download Yara Rule

Strings

d, xrefs: 00B05BA9

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 774f8172f7039a83656fb9be5c8496fbc8a087263439cbda75eaf9e349d7b014
Instruction ID: 61a8a225e110226d0d5315d2ceaddb01b643ca66997fda0470c37f9e2088b2b4
Opcode Fuzzy Hash: 774f8172f7039a83656fb9be5c8496fbc8a087263439cbda75eaf9e349d7b014
Instruction Fuzzy Hash: D0142871D04A2DCACB65DF24CC916AEBBB5FF46344F1086D9E40A7A281EB319AD1CF41

Function 03954BA2 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 208
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 039546D4: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03954812), ref: 039546E6
Part of subcall function 039546D4: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,03954812), ref: 039546F3

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 03954C13
GetSystemMetrics.USER32(0000004D), ref: 03954C1A
GetDC.USER32(00000000), ref: 03954C55
GetCurrentObject.GDI32(00000000,00000007), ref: 03954C68
GetObjectW.GDI32(00000000,00000018,?), ref: 03954C81
DeleteObject.GDI32(00000000), ref: 03954CB3
CreateCompatibleDC.GDI32(00000000), ref: 03954D14
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 03954D35
SelectObject.GDI32(00000000,00000000), ref: 03954D47
BitBlt.GDI32(00000000,00000000,00000000,?,03952468,00000000,?,?,00CC0020), ref: 03954D6C

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

Part of subcall function 03953D76: EnterCriticalSection.KERNEL32(039584D4,00000000,00000000,00000000,?,?,?,?,?,03953EEB,00000000,00000000,00000000,00000000,00000000), ref: 03953D88

Part of subcall function 03953536: GetProcessHeap.KERNEL32(00000000,00000000,0395518A), ref: 0395353D
Part of subcall function 03953536: RtlFreeHeap.NTDLL(00000000), ref: 03953544

DeleteObject.GDI32(00000000), ref: 03954E0A
DeleteDC.GDI32(00000000), ref: 03954E11
ReleaseDC.USER32(00000000,00000000), ref: 03954E1A

Strings

gdi3, xrefs: 03954BBE
U, xrefs: 03954BD3
(, xrefs: 03954CED
2, xrefs: 03954BCA
er32, xrefs: 03954BDA
- ScreenSize: {lWidth=%d, lHeight=%d}, xrefs: 03954C9D
6, xrefs: 03954CF9

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: Object$HeapSection$CriticalDelete$CreateEnterProcess$AllocateCallbackCompatibleCurrentDispatcherFreeHandleLeaveLibraryLoadMetricsModuleReleaseSelectSystemUser
String ID: ($- ScreenSize: {lWidth=%d, lHeight=%d}$2$6$U$er32$gdi3
API String ID: 1387450592-1028866296
Opcode ID: 10ababf5db9d970da31ce92e56abba45f9f4e3a0970a4ff634cc5f3fe2b9fb22
Instruction ID: 1210c64a8a1f6553a1c54aa4f8a9bb8dba55a8e58e0c10f922838311de20b2d5
Opcode Fuzzy Hash: 10ababf5db9d970da31ce92e56abba45f9f4e3a0970a4ff634cc5f3fe2b9fb22
Instruction Fuzzy Hash: 0F71B076E44308ABDB21DFA4DC45BEEBBB8EF44740F144059F905BB280DB709A85CB55

Function 03951000 Relevance: 18.2, APIs: 4, Strings: 6, Instructions: 667
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,?), ref: 039513C7

Part of subcall function 0395407D: GetFileAttributesW.KERNELBASE(03955051,0395447E,?,?,?,?,?,?,?,?,?,?,?,?,?,03953ECC), ref: 0395407E

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

FindFirstFileW.KERNELBASE(00000000,?,0125DB08,?), ref: 03951161

Part of subcall function 03953EFC: FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 03953F5D
Part of subcall function 03953EFC: FindNextFileW.KERNEL32(03951710,?), ref: 03953FFE

EnterCriticalSection.KERNEL32(039584D4), ref: 03951668
LeaveCriticalSection.KERNEL32(039584D4), ref: 03951681

Strings

%s%s, xrefs: 03951487, 039517C7, 0395195D, 039519C2
$Lr, xrefs: 03951281
%s\*, xrefs: 0395112A
Telegram, xrefs: 0395166E
%s\%s, xrefs: 039511A2
7a?=, xrefs: 039516A3

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: File$CriticalFindSection$EnterFirstHeapLeaveNext$AllocateAttributesProcess
String ID: $Lr$%s%s$%s\%s$%s\*$7a?=$Telegram
API String ID: 1893179121-1537637304
Opcode ID: bb8e16c1f88e2ff56773437a68a62ad298719d5a4b7eb8e1e841f383c4299442
Instruction ID: 5fe264b0cd56e22f5ac44a4fb001e817b69237805972fd971b00da7a8fff1e1b
Opcode Fuzzy Hash: bb8e16c1f88e2ff56773437a68a62ad298719d5a4b7eb8e1e841f383c4299442
Instruction Fuzzy Hash: 5F32E776E053145BDF25EFA89890BFDB3B99F84290F18405AFC05AB290EB748EC5C791

Function 03952054 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

GetCurrentHwProfileA.ADVAPI32(?), ref: 0395210B
GetSystemInfo.KERNELBASE(?,?,0000011C), ref: 03952132
GlobalMemoryStatusEx.KERNELBASE(?), ref: 03952166
EnumDisplayDevicesA.USER32(00000000,00000002,?,00000001), ref: 039521E8

Strings

- HWID: %s, xrefs: 0395211F
@, xrefs: 0395215D
- VideoAdapter #%d: %s, xrefs: 039521B4
- CPU: %s (%d cores), xrefs: 03952144
- RAM: %d GB, xrefs: 0395217D

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateCurrentDevicesDisplayEnterEnumGlobalInfoLeaveMemoryProcessProfileStatusSystem
String ID: - CPU: %s (%d cores)$- HWID: %s$- RAM: %d GB$- VideoAdapter #%d: %s$@
API String ID: 330852582-565344305
Opcode ID: 9836a6782f1fb98833a9edbead18f93defaf288b959abd17a416e31602ded897
Instruction ID: f12cb854aa8f21c340c6ba271ce34397bb4a2602950c9d771e9e315224166367
Opcode Fuzzy Hash: 9836a6782f1fb98833a9edbead18f93defaf288b959abd17a416e31602ded897
Instruction Fuzzy Hash: 0A4190726083059BD725DF64C881BABB7E9EBC4350F04492DFD899B241E770DA85CBA2

Function 03954E27 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000), ref: 03954ECD
EnterCriticalSection.KERNEL32(039584D4), ref: 03954F89

Part of subcall function 03954E27: LeaveCriticalSection.KERNEL32(039584D4), ref: 03954FA6

FindNextFileW.KERNELBASE(?,?), ref: 03955175

Part of subcall function 0395407D: GetFileAttributesW.KERNELBASE(03955051,0395447E,?,?,?,?,?,?,?,?,?,?,?,?,?,03953ECC), ref: 0395407E

Strings

%s\*, xrefs: 03954EB7
Telegram, xrefs: 03954F8F
%s\%s, xrefs: 03954EE7

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: File$CriticalFindSection$AttributesEnterFirstLeaveNext
String ID: %s\%s$%s\*$Telegram
API String ID: 648860119-4994844
Opcode ID: eb0c5b90e07d0d64543a8e8a3e6ea41aa1bf1368111ed842756da08e2a8932bc
Instruction ID: 1bd5d18ec655dbb5cec2b5b88450854ae7f1073866aeabe5b9af6881be1b01b7
Opcode Fuzzy Hash: eb0c5b90e07d0d64543a8e8a3e6ea41aa1bf1368111ed842756da08e2a8932bc
Instruction Fuzzy Hash: 6BA1A729A15308A9EF10EBA0EC46BFEB775EF84750F10505AFD04EF2A0E7B14AC58759

Function 03951D3C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?), ref: 03951D83

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

FindNextFileW.KERNELBASE(00000000,?), ref: 03951F07

Strings

%s%s, xrefs: 03951EC1
%s\*, xrefs: 03951D6A
%s\%s, xrefs: 03951E0E

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: CriticalFileFindHeapSection$AllocateEnterFirstLeaveNextProcess
String ID: %s%s$%s\%s$%s\*
API String ID: 3555643018-2064654797
Opcode ID: ac949eb30a5d00a7fad7129687db746e5050a6527c2b93713efed19d0d5e9b38
Instruction ID: 64e3d460fc9326a888eb4b3b6d8103fcab466167845537777a1ae1f9957ee78d
Opcode Fuzzy Hash: ac949eb30a5d00a7fad7129687db746e5050a6527c2b93713efed19d0d5e9b38
Instruction Fuzzy Hash: F641AF796093459BCB14FF24D894B7EB7E8AF84680F04491DFC95CB291EB31CAC98786

Function 03951C94 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 039546D4: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03954812), ref: 039546E6
Part of subcall function 039546D4: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,03954812), ref: 039546F3

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 03951CF3
CryptProtectData.CRYPT32(?,?,00000000,00000000,00000000,00000000,?), ref: 03951D29

Strings

CRYPT32.dll, xrefs: 03951CC2
Poverty is the parent of crime., xrefs: 03951D12

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: CryptData$HandleLibraryLoadModuleProtectUnprotect
String ID: CRYPT32.dll$Poverty is the parent of crime.
API String ID: 3642467563-1885057629
Opcode ID: 18adb523a0127ba1ff43f35819ec2dfa5e9016564af0f35a46c0caa8706d5451
Instruction ID: 8ecf8bb33ff46efe9e35272a68698ac04f17d3e15191e69015d6e513412078ed
Opcode Fuzzy Hash: 18adb523a0127ba1ff43f35819ec2dfa5e9016564af0f35a46c0caa8706d5451
Instruction Fuzzy Hash: B4115CB6D0020CABCF10DF95C880DEEFBBDEB48250F14456AE915B7240E770AE49CBA0

Function 039521F5 Relevance: 38.8, APIs: 13, Strings: 9, Instructions: 304
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(039584D4,00000DA3), ref: 0395220A
CreateMutexA.KERNELBASE(00000000,00000000,1e7f31ac-1494-47cc-9633-054c20e7432e), ref: 03952222
GetLastError.KERNEL32 ref: 03952235

Strings

@, xrefs: 03952551
systemd, xrefs: 03952566
- UserAgent: %s, xrefs: 03952526
kernel32, xrefs: 039523AC
1e7f31ac-1494-47cc-9633-054c20e7432e, xrefs: 03952219, 03952585
$, xrefs: 03952570
- OperationSystem: %d:%d:%d, xrefs: 0395229D
$d.log, xrefs: 039525EB
shell32, xrefs: 03952358

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: CountCreateCriticalErrorInitializeLastMutexSectionSpin
String ID: $$$d.log$- OperationSystem: %d:%d:%d$- UserAgent: %s$1e7f31ac-1494-47cc-9633-054c20e7432e$@$kernel32$shell32$systemd
API String ID: 2005177960-3436640841
Opcode ID: 56d9164251e84da86e7f0cf966a9fa56ce8087881888529cb3c1999426e4b2d0
Instruction ID: ddf98d5c332e07dd25d40eb3589ac51a1d410968d9a77038ef3595e7cdf8bf81
Opcode Fuzzy Hash: 56d9164251e84da86e7f0cf966a9fa56ce8087881888529cb3c1999426e4b2d0
Instruction Fuzzy Hash: FBC1D235A08348AAEB11FFA0EC49BED7BB5AF85701F040459FE45AE2D1DB714AC5CB21

Function 0395446C Relevance: 16.7, APIs: 8, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0395407D: GetFileAttributesW.KERNELBASE(03955051,0395447E,?,?,?,?,?,?,?,?,?,?,?,?,?,03953ECC), ref: 0395407E

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

EnterCriticalSection.KERNEL32(039584D4), ref: 039544F5
LeaveCriticalSection.KERNEL32(039584D4), ref: 03954541
EnterCriticalSection.KERNEL32(039584D4), ref: 039545C4
LeaveCriticalSection.KERNEL32(039584D4), ref: 039545FD
EnterCriticalSection.KERNEL32(039584D4), ref: 0395463A
LeaveCriticalSection.KERNEL32(039584D4), ref: 0395467D
EnterCriticalSection.KERNEL32(039584D4), ref: 03954696
LeaveCriticalSection.KERNEL32(039584D4), ref: 039546BF

Part of subcall function 039542EC: GetModuleHandleA.KERNEL32(ntdll,NtQuerySystemInformation,00000000,00000000,00000000,?,?,?,?,03954574), ref: 03954305
Part of subcall function 039542EC: GetProcAddress.KERNEL32(00000000), ref: 0395430E
Part of subcall function 039542EC: GetModuleHandleA.KERNEL32(ntdll,NtQueryObject,?,?,?,?,03954574), ref: 0395431F
Part of subcall function 039542EC: GetProcAddress.KERNEL32(00000000), ref: 03954322
Part of subcall function 039542EC: OpenProcess.KERNEL32(00000040,00000000,00000000,?,?,?,?,03954574), ref: 039543A4
Part of subcall function 039542EC: GetCurrentProcess.KERNEL32(03954574,00000000,00000000,00000002,?,?,?,?,03954574), ref: 039543C0
Part of subcall function 039542EC: DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,03954574), ref: 039543CF
Part of subcall function 039542EC: CloseHandle.KERNEL32(03954574,?,?,?,?,03954574), ref: 039543FF

Part of subcall function 03953536: GetProcessHeap.KERNEL32(00000000,00000000,0395518A), ref: 0395353D
Part of subcall function 03953536: RtlFreeHeap.NTDLL(00000000), ref: 03953544

Strings

@, xrefs: 039544DB
\??\%s, xrefs: 039544A4
\Network\Cookies, xrefs: 03954561

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$HandleHeapProcess$AddressModuleProc$AllocateAttributesCloseCurrentDuplicateFileFreeOpen
String ID: @$\??\%s$\Network\Cookies
API String ID: 330363434-2791195959
Opcode ID: 187cad080726269c1ff22075bf1dea7e108bb0f7364f6971c4c3dfa8d95ecc89
Instruction ID: 0d9241a45515a6a9f15f5cc6ad88bfd45994f50b8cc0e95c3f65bc096ee4dd2e
Opcode Fuzzy Hash: 187cad080726269c1ff22075bf1dea7e108bb0f7364f6971c4c3dfa8d95ecc89
Instruction Fuzzy Hash: F1714A75A45308AFEB44EFA0D849BEDBBB5FB44305F108015F901AE1D1DBB19AC6CB40

Function 0395536D Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 138
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 039546D4: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03954812), ref: 039546E6
Part of subcall function 039546D4: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,03954812), ref: 039546F3

socket.WS2_32(?,00000001,00000000), ref: 03955480
connect.WS2_32(000000FF,?,00000010), ref: 039554BF
send.WS2_32(000000FF,00000000,00000000), ref: 039554E1
send.WS2_32(000000FF,000000FF,00000037,00000000), ref: 039554FD

Strings

ws2_32.dll, xrefs: 039553E8
146.70.169.164, xrefs: 03955494

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: send$HandleLibraryLoadModuleconnectsocket
String ID: 146.70.169.164$ws2_32.dll
API String ID: 2781119014-4085977579
Opcode ID: 80d0bcaaece3839958009f2467f60f34958ad7b868983d41641659e5770b8649
Instruction ID: 43a33b6f295c8b81453385f5dec7e907ed23e3dce36bc9df8182da9b77c58bae
Opcode Fuzzy Hash: 80d0bcaaece3839958009f2467f60f34958ad7b868983d41641659e5770b8649
Instruction Fuzzy Hash: 8851A631D08289EEEB12CBE8D8097EDBFB89F16314F144599E951AE1C2C3B54786CB61

Function 00B0F990 Relevance: 11.6, APIs: 4, Strings: 1, Instructions: 2890COMMON

Download Yara Rule

Strings

d, xrefs: 00B0F999

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 915b5c3b5aedb868d7d7a0d60acd46e1eafac67fa7c0708e82e2132fbb9fde76
Instruction ID: 32778d4870c5c5f6d12521e51214cbd80ae15e2a0ebc7b2db31e950d26fee74d
Opcode Fuzzy Hash: 915b5c3b5aedb868d7d7a0d60acd46e1eafac67fa7c0708e82e2132fbb9fde76
Instruction Fuzzy Hash: CD632370C04A1CCACB26DF68D9916EEF7B5FF56344F1086D9E40A3A241EB31AAD19F41

Function 00B13FE0 Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 705
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 00B13FE9

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 53e270ec0a0397a4b3b96f19ede937faa645044f13fd83d745685422895ad34e
Instruction ID: 1e0672645b4e0db2492430840c4f039a6861b6305f6e7520a518efb6111f0a82
Opcode Fuzzy Hash: 53e270ec0a0397a4b3b96f19ede937faa645044f13fd83d745685422895ad34e
Instruction Fuzzy Hash: B1722670C00A18CACB15DFA8D8916EEFBB5FF56344F5082D9E41A7B281EB319AD5CB41

Function 00B159F0 Relevance: 10.0, APIs: 2, Strings: 1, Instructions: 5515COMMON

Download Yara Rule

Strings

d, xrefs: 00B159F9

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 74a347a7bbedac585a1bad9f3505b5b93ac8279d4373f93fcf68a89a05cdd2be
Instruction ID: bf2920bfd2f6a7469009ea42fd243ff0a153b0d89a29c07bcdf215771d11e956
Opcode Fuzzy Hash: 74a347a7bbedac585a1bad9f3505b5b93ac8279d4373f93fcf68a89a05cdd2be
Instruction Fuzzy Hash: C6D32571C04A18CACB26DF68C9916EEF7B5FF56344F5082DAE40A3A241DB31AAD1DF41

Function 0395484B Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 231
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040,0000011C,?,?,?,?,?,039522C4), ref: 0395486C

Part of subcall function 039546D4: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03954812), ref: 039546E6
Part of subcall function 039546D4: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,03954812), ref: 039546F3

GetCurrentProcess.KERNEL32(039522C4), ref: 039548E0
IsWow64Process.KERNEL32(00000000), ref: 039548E7

Strings

l, xrefs: 0395488C
ntdl, xrefs: 03954889

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentHandleLibraryLoadModuleVirtualWow64
String ID: l$ntdl
API String ID: 1207166019-924918826
Opcode ID: 1388d17f6c5f13b60ab52eea72f710e224dbd60427db4ebf1f35b3898e5ec91a
Instruction ID: 748c2c28bbb5ee8a7511ffc3bb7002dab9711fbde0c2bf3f0201c6864f7dfe5a
Opcode Fuzzy Hash: 1388d17f6c5f13b60ab52eea72f710e224dbd60427db4ebf1f35b3898e5ec91a
Instruction Fuzzy Hash: 2F81903170C3059AEBA4EE55E85AB7D33ACFB00751F14095AFE099F2D4E7B489C48B46

Function 00B13052 Relevance: 6.0, APIs: 4, Instructions: 32
librarysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 00B1307F
CreateThread.KERNELBASE(00000000,00000000,?,00000000,00000000,00000000), ref: 00B130A2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B130B7
FreeLibrary.KERNEL32(?), ref: 00B130C4

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Library$CreateFreeLoadObjectSingleThreadWait
String ID:
API String ID: 2432312608-0
Opcode ID: 6ba41e12b9e8275c6c732021f52bde7cb949d8f0fcab8169cbb0701a23742322
Instruction ID: acb58b72dcaf0760773d806c63da935dac965cc1e9ba5c373e8009d5f8c07e8f
Opcode Fuzzy Hash: 6ba41e12b9e8275c6c732021f52bde7cb949d8f0fcab8169cbb0701a23742322
Instruction Fuzzy Hash: 56011970A803189BDB248F64DC8CBAA77B4FB14715F1006C8EA2D5B2A1DAB16EC0CF50

Function 03953508 Relevance: 6.0, APIs: 4, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID:
API String ID: 1367039788-0
Opcode ID: 0acf4077344b9a46b92d4e741184495c367dc0772868059a6daca29591ed423e
Instruction ID: 966bd4f902fa063083369b158298d51c5655a32c51f7856c1e740623f470e503
Opcode Fuzzy Hash: 0acf4077344b9a46b92d4e741184495c367dc0772868059a6daca29591ed423e
Instruction Fuzzy Hash: 41D0C73360932067CB507BF9BC0C99BBFECEF95562B05005AF605CB154CAB4CD8587A0

Function 039546D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,03954812), ref: 039546E6
LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,03954812), ref: 039546F3

Strings

ntdl, xrefs: 039546E1, 039546F2

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: ntdl
API String ID: 4133054770-3973061744
Opcode ID: 2810d73eff298fb488da34da9dba1283c9772a61656f625ae91c95948ca26f46
Instruction ID: de4aa55e164b5ab11e5da39d261e117f3813dd1232a3e884788fd4ea18bd18d5
Opcode Fuzzy Hash: 2810d73eff298fb488da34da9dba1283c9772a61656f625ae91c95948ca26f46
Instruction Fuzzy Hash: F1318E79E006159BCB64CFAEC890ABDF7B9BF4A714F080299E81197741C7349AD1CBA0

Function 00B5FCA5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___scrt_release_startup_lock.LIBCMT ref: 00B5FCF5
___scrt_uninitialize_crt.LIBCMT ref: 00B5FD72

Strings

VPWh, xrefs: 00B5FD4E

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ___scrt_release_startup_lock___scrt_uninitialize_crt
String ID: VPWh
API String ID: 3421992214-353207083
Opcode ID: ffe97b70b4a9aff73ffaf7793dee2d78539017e7c6c25e68fdc42ce65377ba23
Instruction ID: dcd8548e9ac34cfa23ee105f66172608685b0ade9854ff7a1bdb574dc54a9d00
Opcode Fuzzy Hash: ffe97b70b4a9aff73ffaf7793dee2d78539017e7c6c25e68fdc42ce65377ba23
Instruction Fuzzy Hash: 7921263258831766DA207B74A807B7EA7F0DF42762F2001FAFD95776E2DF2A4C458690

Function 00B6EDE2 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00B6EF97

Part of subcall function 00B6AC15: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00B5FB1F,00000000,?,00B1322C,00000000,?,00B013A5,00000000), ref: 00B6AC47

__freea.LIBCMT ref: 00B6EFAA
__freea.LIBCMT ref: 00B6EFB7

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: 60ac8868f2cdc90c16b44d54fec3b027831b549ce98234f5ad2433bc4f60efdd
Instruction ID: 92fdf9af562fb9a4b6bdd9ef4af4df716731af53face70d08badfb8988fe899c
Opcode Fuzzy Hash: 60ac8868f2cdc90c16b44d54fec3b027831b549ce98234f5ad2433bc4f60efdd
Instruction Fuzzy Hash: 6451B176600206AFEB219E648C85EBB7AE9EF94310B1500A9FD28D7140EB39CC50CB61

Function 00B72F61 Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00B72A95: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 00B72AC0

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00B72DA5,?,00000000,?,00000000,?), ref: 00B72FC2
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B72DA5,?,00000000,?,00000000,?), ref: 00B72FFE

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: c61e9a9d0864cdd92f736376b1d81160a737cefb2460b89604e1f891c80eac80
Instruction ID: cd2d86eb559df2942201df841f6971137fcc2f072b81a9439ec5a9492c13297b
Opcode Fuzzy Hash: c61e9a9d0864cdd92f736376b1d81160a737cefb2460b89604e1f891c80eac80
Instruction Fuzzy Hash: 63512370A003458EDB20CF36C881BABBBF5EF41700F14C4EED1AA8B251E6799A46DB50

Function 00B6E1D3 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

LCMapStringEx.KERNELBASE(?,00B6EED2,?,?,-00000008,?,00000000,00000000,00000000,00000000,00000000), ref: 00B6E207
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,-00000008,-00000008,?,00B6EED2,?,?,-00000008,?,00000000), ref: 00B6E225

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 998711c8c7f21b6641c743dafbb62d3c689665fb3bdb5f34e5db8cc9de8a6266
Instruction ID: 6bca05ec78f82a45ae199b4734643e7c70ee528552a9b6c842ba960120492bb9
Opcode Fuzzy Hash: 998711c8c7f21b6641c743dafbb62d3c689665fb3bdb5f34e5db8cc9de8a6266
Instruction Fuzzy Hash: F7F07A3640011AFBCF126F91DC15DDE7F6AFF487A0F058451FA2826020CB36D871AB90

Function 03953536 Relevance: 3.0, APIs: 2, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,0395518A), ref: 0395353D
RtlFreeHeap.NTDLL(00000000), ref: 03953544

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 33c5cb783e0d5051a8ed90a7e71b256693a767a9bad2adb0bb9c96e2741c6c50
Instruction ID: 65435de679f541826e9c54aef9bcb98c37c1cdab38331e55de40919be67102e2
Opcode Fuzzy Hash: 33c5cb783e0d5051a8ed90a7e71b256693a767a9bad2adb0bb9c96e2741c6c50
Instruction Fuzzy Hash: 34B092765092006AEE88ABF0990DB3A3758AB00643F041088B60699044867882808720

Function 00B72B69 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(FFFFF9B2,?,00000005,00B72DA5,?), ref: 00B72B9B

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: bef85f60a0bf3c86c509aae581a1d7c8d6eee0fffc0b5df0821f6abae3be2772
Instruction ID: 7956bcef164ab7f36aaf255305278612192dfb7f3024a367606351bcba008a54
Opcode Fuzzy Hash: bef85f60a0bf3c86c509aae581a1d7c8d6eee0fffc0b5df0821f6abae3be2772
Instruction Fuzzy Hash: 905128B1904158AFDB128F28CDC4BE9BBECFB25304F1481E9E5AD97182D3359D89DB60

Function 00B5FB05 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00B6037B

Part of subcall function 00B6106C: RaiseException.KERNEL32(E06D7363,00000001,00000003,00B6038E,?,?,?,?,00B6038E,?,00B88484), ref: 00B610CC

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ExceptionRaisestdext::threads::lock_error::lock_error
String ID:
API String ID: 3447279179-0
Opcode ID: a2989f266198f251bcef4a1aa11a935caad227fdaf6f400903f9b93910efcc81
Instruction ID: 351b59f7e1c28aa445a01609067b0e15a1a67cf8afd39257804913856cf6a123
Opcode Fuzzy Hash: a2989f266198f251bcef4a1aa11a935caad227fdaf6f400903f9b93910efcc81
Instruction Fuzzy Hash: EAF0B43580020EF7CF04BAA9EC5AEAD77ECD904310B5445F0BD68960E2EF74EA49C2D5

Function 00B01460 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 00B01477

Part of subcall function 00B13D80: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 00B13D89

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Concurrency::cancel_current_taskstdext::threads::lock_error::lock_error
String ID:
API String ID: 2103942186-0
Opcode ID: 7e938961fb2e67025cdff9c0a0f1d748bbed45857ce640becdc6d9bdc5e37106
Instruction ID: d6e96f8272578e6564fa97222bc0cf27975b168814a8ae388ae13e0fc06b7605
Opcode Fuzzy Hash: 7e938961fb2e67025cdff9c0a0f1d748bbed45857ce640becdc6d9bdc5e37106
Instruction Fuzzy Hash: 2DF0EC74D01108ABCB18EFACD5C16ADBBF5EF44304F1085E9E80597395E634AF90DB85

Function 00B6AC15 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00B5FB1F,00000000,?,00B1322C,00000000,?,00B013A5,00000000), ref: 00B6AC47

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 30555f1723c36425e9c4cd49b11093fde15966a6958065fe3659e83d32fe19c1
Instruction ID: 5765daeead0ef30588b384b2b6c67cc03b649e14116acd3d444c902794644d82
Opcode Fuzzy Hash: 30555f1723c36425e9c4cd49b11093fde15966a6958065fe3659e83d32fe19c1
Instruction Fuzzy Hash: 28E0E531144A1597DF3136759C00B9ABBC8DB427A0F1401E1FD05B62D0CF6CCC008AA6

Function 00B37B09 Relevance: 1.5, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00000007,?,?), ref: 00B14B9E

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: dfc1135ad05bd7b55a7458c7a2da7ea58797dcec1e4b7e494a1e0ea480c6509a
Instruction ID: 1595791b72d0eecf481a9b36c6c2aaa88bfc2bdb9391661fbb09106d23f2d45d
Opcode Fuzzy Hash: dfc1135ad05bd7b55a7458c7a2da7ea58797dcec1e4b7e494a1e0ea480c6509a
Instruction Fuzzy Hash: 2AD012B6A5410987CB209B78AC487A677B8F704316B2411C9E95C47122DF324555CF40

Function 00B013B0 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

allocator.LIBCONCRTD ref: 00B013BC

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: allocator
String ID:
API String ID: 3447690668-0
Opcode ID: 571f10d42482652b194d7ecda06d937b3b08c569b6719ab49de57ad63638ba45
Instruction ID: 65b633b394732e28292e4e597070b363141f2f56fe8368c17303685b94595d74
Opcode Fuzzy Hash: 571f10d42482652b194d7ecda06d937b3b08c569b6719ab49de57ad63638ba45
Instruction Fuzzy Hash: 3EC09B7011410C5B8704DF88E491D5673DD9B897107404155BC0D4B351CB30FD40C554

Function 0395407D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(03955051,0395447E,?,?,?,?,?,?,?,?,?,?,?,?,?,03953ECC), ref: 0395407E

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 615d235629243ab6daf6a172034775f8fb89b6eb5c6a2722820004028f0fe564
Instruction ID: bfae20a370ac27defced349cb626dbc1e802e4f04ba38fe9b0e33a59a88fff02
Opcode Fuzzy Hash: 615d235629243ab6daf6a172034775f8fb89b6eb5c6a2722820004028f0fe564
Instruction Fuzzy Hash: 5CA0223A0303008BCA2C23302B2A00E30800E0A2F03220B8CB033CC0C0EA38C3C00200

Function 00B27EEA Relevance: 1.3, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000001,00003000,00000040), ref: 00B18B81

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3583760f87a92a23fb6b449d333bf749266136b35941c51d66e5c0d92b45eaa9
Instruction ID: c7db99d0218fc8705587d61e0780df8e0d1a08917fa7c723416b314d40219714
Opcode Fuzzy Hash: 3583760f87a92a23fb6b449d333bf749266136b35941c51d66e5c0d92b45eaa9
Instruction Fuzzy Hash: D521E3B1C05928CADB62CF28C9817EDB7B5FF52340F1092C6D40D6A242DB319AC19F50

Non-executed Functions

Function 03953EFC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0395407D: GetFileAttributesW.KERNELBASE(03955051,0395447E,?,?,?,?,?,?,?,?,?,?,?,?,?,03953ECC), ref: 0395407E

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 03953F5D
FindNextFileW.KERNEL32(03951710,?), ref: 03953FFE

Strings

%s%s, xrefs: 03954047
%s\*, xrefs: 03953F47
%s\%s, xrefs: 03953F97

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: File$CriticalFindHeapSection$AllocateAttributesEnterFirstLeaveNextProcess
String ID: %s%s$%s\%s$%s\*
API String ID: 674214967-2064654797
Opcode ID: 95b60926543a8d98a3b0e6996a2a3850f789e1bd387f2236ed4fac16d899a4fd
Instruction ID: c7ea96e5a88601de5e2454bd5f2a20b463a10c8c2d4d0010643e4c7059581374
Opcode Fuzzy Hash: 95b60926543a8d98a3b0e6996a2a3850f789e1bd387f2236ed4fac16d899a4fd
Instruction Fuzzy Hash: 6131CB7AA0131967DB61FE75CC85BBDB7799F81290F080198FC059B290EB358FC68B51

Function 00B75458 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 00B754F1
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 00B7551A
GetACP.KERNEL32 ref: 00B7552F

Strings

ACP, xrefs: 00B75476
OCP, xrefs: 00B754AC

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 56da3b592bb763dc233a8bd67da2245cc22ab3523c4a05e04a3c29cb32d8728a
Instruction ID: 1ca50ec12c0774be271bdff8bddee153dbb409e5ac0050c4cf39caf93c3b8ffa
Opcode Fuzzy Hash: 56da3b592bb763dc233a8bd67da2245cc22ab3523c4a05e04a3c29cb32d8728a
Instruction Fuzzy Hash: 1721B272600904A6EB308F55D905B9773F7EB60B61B66C4E4E92DD7204FBB2DE80C750

Function 00B75634 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

GetUserDefaultLCID.KERNEL32 ref: 00B7573C
IsValidCodePage.KERNEL32(00000000), ref: 00B7577A
IsValidLocale.KERNEL32(?,00000001), ref: 00B7578D
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 00B757D5
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 00B757F0

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 189458151bb3e9f0012cd2ae9f2a74284361ebe9328495c06797db37e88d69cd
Instruction ID: c04ecf970a28fe0137cf5f3f723d6173579ca7c2cca7d7eb93a97b98b1ae6825
Opcode Fuzzy Hash: 189458151bb3e9f0012cd2ae9f2a74284361ebe9328495c06797db37e88d69cd
Instruction Fuzzy Hash: 52515F71A10609ABEB24DFA4CC41BAE77F8FF44700F5484A9E929E7191EBB0DD40CB61

Function 039540BA Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 0395410D
FindNextFileW.KERNEL32(000000FF,?), ref: 03954159

Part of subcall function 03953536: GetProcessHeap.KERNEL32(00000000,00000000,0395518A), ref: 0395353D
Part of subcall function 03953536: RtlFreeHeap.NTDLL(00000000), ref: 03953544

Strings

%s\*, xrefs: 039540F7
%s\%s, xrefs: 0395416D

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: FileFindHeap$FirstFreeNextProcess
String ID: %s\%s$%s\*
API String ID: 1689202581-2848263008
Opcode ID: 3fcdf23f08f7bfcf0ba462d14c464e2152e7ff45fa315f79ebe77d116405b2db
Instruction ID: 0f428b5d6794f63286cccd8a0af6046c9fdc9fbf712496c4b8fb5cafee2f0972
Opcode Fuzzy Hash: 3fcdf23f08f7bfcf0ba462d14c464e2152e7ff45fa315f79ebe77d116405b2db
Instruction Fuzzy Hash: AB31A8397013149BCB60FF66DCC476F7BA9AF94290F144469FD05DB245EB348AD18B90

Function 00B7256E Relevance: 6.2, APIs: 4, Instructions: 206fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00B7265E
FindNextFileW.KERNEL32(00000000,?), ref: 00B72752
FindClose.KERNEL32(00000000), ref: 00B72791
FindClose.KERNEL32(00000000), ref: 00B727C4

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: 6c54a34a7341fa75546d97f4b9ca0cc53c6b91a9847da419951ae10937ddd2d9
Instruction ID: 4930a6ceab4ff19484fbe24b3fc66a5e4e477e856c6bed0b881a02840d91aa61
Opcode Fuzzy Hash: 6c54a34a7341fa75546d97f4b9ca0cc53c6b91a9847da419951ae10937ddd2d9
Instruction Fuzzy Hash: 4271E375D051586FDF24AF38CC99AAABBF9EF15300F1481DAE06DA7211EB358E819F10

Function 00B60495 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00B604A1
IsDebuggerPresent.KERNEL32 ref: 00B6056D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00B60586
UnhandledExceptionFilter.KERNEL32(?), ref: 00B60590

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 605acf10066315b446696d73d16a60f8158cb18d81755abb8d5724581967fac3
Instruction ID: 58cde7079f4ec1325eb7209d0e9bc24087fa2fb9da057f78c1c0ea229a8d6140
Opcode Fuzzy Hash: 605acf10066315b446696d73d16a60f8158cb18d81755abb8d5724581967fac3
Instruction Fuzzy Hash: 7D31F875D152189BDF20EF65D9897CEBBF8AF08300F1041EAE50DAB250EB759A84CF45

Function 00B750DC Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B75130
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B7517A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B75240

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 0f0c300a04528b46f0ecdf6d67442070f2f9e5d54c9619df38224487b5665b8e
Instruction ID: 2f232d58f5a7d69f097b545f0d24e7b1ea06c8f9081f84ab469148604127c727
Opcode Fuzzy Hash: 0f0c300a04528b46f0ecdf6d67442070f2f9e5d54c9619df38224487b5665b8e
Instruction Fuzzy Hash: 28618171914A079FDB389F28CC82BAA77E9EF14340F1080E9E929C6595F7B4D981DB50

Function 00B64383 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00B6447B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00B64485
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00B64492

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 4ba79a62f7825dd55b4852cfd6e0554d73edf2a4a7762d1fc43d80fe969eed75
Instruction ID: f0070fcfe7c1ff12f90067634933ed8b7d51988f00457d75c50a552bb24863e8
Opcode Fuzzy Hash: 4ba79a62f7825dd55b4852cfd6e0554d73edf2a4a7762d1fc43d80fe969eed75
Instruction Fuzzy Hash: F231C2749112289BCB21DF65D88978DBBF8BF08310F5042EAE50CA7250EB749B858F44

Function 00B6D515 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B6D510,?,?,00000008,?,?,00B77A3B,00000000), ref: 00B6D742

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: afa790d1512cd33fe5dbc83136ce026f817ad6eb89ed3486c732b30879799ade
Instruction ID: ae4803dfb755384afddd3f77420db81e7c5f3dfe84ad89abbb55ac3de9bd8f74
Opcode Fuzzy Hash: afa790d1512cd33fe5dbc83136ce026f817ad6eb89ed3486c732b30879799ade
Instruction Fuzzy Hash: 89B13D31A106089FD715CF28C48AB657BE0FF45364F298698E89ACF2A1C739DD91CB41

Function 00B6013C Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00B60152

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dd50c1296988248900fb5d2e7af77ada69a3f84b1447ba353251fe8108d561ea
Instruction ID: 5d059ab7376f8ba792d5dc49ce312ebbee1073c5d0094a5a7910e92e491c48b9
Opcode Fuzzy Hash: dd50c1296988248900fb5d2e7af77ada69a3f84b1447ba353251fe8108d561ea
Instruction Fuzzy Hash: FD5180B19112058FEB15CFA5D8C6BAEBBF4FB48310F2885AAD406EB361D7789D40CB50

Function 00B7532F Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B75383

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ec9ef138ffef8c8d5a4d0f62cd1389f7829148ccd7432c38f3ad703e53ac7fc8
Instruction ID: 3e7e8c509af98cabcfe40a1a749a565e54fb597a0f409e09ab964093951ef4a8
Opcode Fuzzy Hash: ec9ef138ffef8c8d5a4d0f62cd1389f7829148ccd7432c38f3ad703e53ac7fc8
Instruction Fuzzy Hash: 3621F532611606ABDB289F18CC81A7A33F8EF40340F1180FAF91AD7151EBB8EC81CB54

Function 00B74FB6 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

EnumSystemLocalesW.KERNEL32(00B750DC,00000001), ref: 00B75028

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a75623c07533a868533a76ad2e16022e6b69b54a08df666242c7e75ef9e30dcd
Instruction ID: 481ad5c4c8de70d46399e65ee6c2b15386cf87091b050ca04576943e896a48dc
Opcode Fuzzy Hash: a75623c07533a868533a76ad2e16022e6b69b54a08df666242c7e75ef9e30dcd
Instruction Fuzzy Hash: 5E1129362007059FDB289F38C89157AB7D2FF80359B14842CE95A87640D7717842DB80

Function 00B7555E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B752F8,00000000,00000000,?), ref: 00B7558A

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 406e97a4489bccacf33864366e868b943686f2ee4bba0e4edf718f93f979917b
Instruction ID: 0be3732f01a60246333114bdc51e6227e351f21be8a6955468ef89049e445278
Opcode Fuzzy Hash: 406e97a4489bccacf33864366e868b943686f2ee4bba0e4edf718f93f979917b
Instruction Fuzzy Hash: BB01D632600613ABDB389A248C45BBB37E5EB40754F1584A9EC1AE31C0EAB4FE41C790

Function 00B75051 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

EnumSystemLocalesW.KERNEL32(00B7532F,00000001), ref: 00B7509B

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 52ba7b40fed31f7eeee2d4ee10ef82134c6db848b081814521197e341edf648f
Instruction ID: 558069c04bb4bdcfbb6aee417ef03a5a129a5521481c9483aad31c3f0858f775
Opcode Fuzzy Hash: 52ba7b40fed31f7eeee2d4ee10ef82134c6db848b081814521197e341edf648f
Instruction Fuzzy Hash: 5BF0F636300B045FDB346F399C81A7A7BE1EF80768B0584ADF94A8B690D6F19C42C794

Function 00B6DBC7 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 00B649CA: EnterCriticalSection.KERNEL32(-00B8B8A8,?,00B676D7,00000000,00B88C40,0000000C,00B6769F,?,?,00B6DB90,?,?,00B6AA8E,00000001,00000364,00000000), ref: 00B649D9

EnumSystemLocalesW.KERNEL32(Function_0006DBBA,00000001,00B88E30,0000000C,00B6DF92,?), ref: 00B6DBFF

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 384ab4d82ff9a0fc97a17fd0bd35f89fcc470cc9be7876946549776179ffbfc8
Instruction ID: 0c85a32a8709eaba2facafc0e6cf3b9328c9318cfab2d2f62df80bed7789e5ab
Opcode Fuzzy Hash: 384ab4d82ff9a0fc97a17fd0bd35f89fcc470cc9be7876946549776179ffbfc8
Instruction Fuzzy Hash: 6BF0E772A54214DFD700EFA8E842B9E77F0EB09725F1045AAE5159B2B1CBB95900CF50

Function 00B74F69 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

EnumSystemLocalesW.KERNEL32(00B74EC4,00000001), ref: 00B74FA2

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 15d0761aaf6facc232463ad4e480e7d6968f948d529d6f293395dd99423a6164
Instruction ID: a1ee690ca5d3b56a7e1b68f2e23650e755c288c80afaa50ef82b5d71c110dce7
Opcode Fuzzy Hash: 15d0761aaf6facc232463ad4e480e7d6968f948d529d6f293395dd99423a6164
Instruction Fuzzy Hash: B0F0E5367002455BCF049F39D84566BBFE4EFC1761B068099EE1D8F691C7759883C790

Function 00B74F6B Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00B6A8F0: GetLastError.KERNEL32(?,?,00B671B7,?,?,?,?,00000003,00B64382,?,00B642F1,?,00000000,00B64500), ref: 00B6A8F4
Part of subcall function 00B6A8F0: SetLastError.KERNEL32(00000000,00000000,00B64500,?,?,?,?,?,00000000,?,?,00B6459E,00000000,00000000,00000000,00000000), ref: 00B6A996

EnumSystemLocalesW.KERNEL32(00B74EC4,00000001), ref: 00B74FA2

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: cde7bb279d70adc340d82657b281548a7afd86754773c88817b5ed0663edf413
Instruction ID: aeb3981a97465ee2e47e5bcc43f31f9fc33b68731ca13272069062d982ffad0c
Opcode Fuzzy Hash: cde7bb279d70adc340d82657b281548a7afd86754773c88817b5ed0663edf413
Instruction Fuzzy Hash: 5EF0E5367002455BCF049F39D84566ABFE4EFC1761B068099EE1D8F691C7759882C790

Function 00B6E096 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00B69527,?,20001004,00000000,00000002,?,?,00B68B19), ref: 00B6E0CA

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 20de071e6ce5fa3df12d8adb6e96e209633daa93d52a853796aa2c56610adfb6
Instruction ID: dd16101537465ef54a9f59f87d7c2b075f43475c52526a3c9d915af66ace5651
Opcode Fuzzy Hash: 20de071e6ce5fa3df12d8adb6e96e209633daa93d52a853796aa2c56610adfb6
Instruction Fuzzy Hash: 06E01A35501128BBCB122F61DC05B9E7B6AFB44750F044450FC19A6161CB769920EB95

Function 00B60622 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0006062E,00B5FC56), ref: 00B60627

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5ec7062b1714dc59dcbe91f516ffc8c8cd48b4763b302d519c9260a4802afabb
Instruction ID: e768dd1b1b65b5e4aadd587030d0766665b890177755663c2c480ebc5eec0677
Opcode Fuzzy Hash: 5ec7062b1714dc59dcbe91f516ffc8c8cd48b4763b302d519c9260a4802afabb
Instruction Fuzzy Hash:

Function 00B75891 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00B75891

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 1988379d86344af932cdfd20684df1b0c01e09a3e18206d08620e705dec504f3
Instruction ID: e6566a67f20f04a8d75da6478c0c13c68c3d5068194afab33871971fb509149a
Opcode Fuzzy Hash: 1988379d86344af932cdfd20684df1b0c01e09a3e18206d08620e705dec504f3
Instruction Fuzzy Hash: D2A00270612247DF97408F75AF0D70D3BF9BA49AD1F4581A9A509D7570EF3484A0DF05

Function 00B6BE09 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc8808c31b174ddf89346739b1d3643f3fcbc20842dcc3a577d53a87946a5f63
Instruction ID: b26e81727fce40e44a3b2c573c2d4e9992a527e9c78f1eaed5357a55088fba48
Opcode Fuzzy Hash: dc8808c31b174ddf89346739b1d3643f3fcbc20842dcc3a577d53a87946a5f63
Instruction Fuzzy Hash: 19322521D69F014DD7239634CC62335AA89AFB73C4F15D73BE85AB6AA5EF29D4C34200

Function 00B61490 Relevance: .1, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e1801c34709f214b4302f7bd2f5dce033b5fbcf0890abfc77c15e02a15e7aac7
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5F115B7720118243D614CA7ED8B45B6E3E5FBD532072C8BFAC0434B748D92AD9409E00

Function 039542EC Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQuerySystemInformation,00000000,00000000,00000000,?,?,?,?,03954574), ref: 03954305
GetProcAddress.KERNEL32(00000000), ref: 0395430E
GetModuleHandleA.KERNEL32(ntdll,NtQueryObject,?,?,?,?,03954574), ref: 0395431F
GetProcAddress.KERNEL32(00000000), ref: 03954322

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

OpenProcess.KERNEL32(00000040,00000000,00000000,?,?,?,?,03954574), ref: 039543A4
GetCurrentProcess.KERNEL32(03954574,00000000,00000000,00000002,?,?,?,?,03954574), ref: 039543C0
DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,03954574), ref: 039543CF
CloseHandle.KERNEL32(03954574,?,?,?,?,03954574), ref: 039543FF
GetCurrentProcess.KERNEL32(03954574,00000000,00000000,00000001,?,?,?,?,03954574), ref: 0395440D
DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,03954574), ref: 0395441C
CloseHandle.KERNEL32(?,?,?,?,?,03954574), ref: 0395442F
CloseHandle.KERNEL32(000000FF), ref: 03954452
CloseHandle.KERNEL32(?), ref: 0395445A

Strings

NtQueryObject, xrefs: 03954310
NtQuerySystemInformation, xrefs: 039542FB
ntdll, xrefs: 03954300, 03954317

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: Handle$CloseProcess$AddressCriticalCurrentDuplicateHeapModuleProcSection$AllocateEnterLeaveOpen
String ID: NtQueryObject$NtQuerySystemInformation$ntdll
API String ID: 3110323036-2044536123
Opcode ID: 2b3d5d5128817a858a9871de7c3a5b22bc6f71056573a8d8e038c3d28ef47ec4
Instruction ID: 9454fa3ff7a3231261eab2ac0c115fc3cfc02c571b9d8f1459df0c99070cdbde
Opcode Fuzzy Hash: 2b3d5d5128817a858a9871de7c3a5b22bc6f71056573a8d8e038c3d28ef47ec4
Instruction Fuzzy Hash: B0415E72A00219ABDB10EFF69C44AAEBBBDEF84651F144165F914E7190DB70DAC1CBA0

Function 00B03930 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B03959
_Yarn.LIBCPMTD ref: 00B0396B
_Yarn.LIBCPMTD ref: 00B0397A
_Yarn.LIBCPMTD ref: 00B03989
_Yarn.LIBCPMTD ref: 00B03998
_Yarn.LIBCPMTD ref: 00B039A7
_Yarn.LIBCPMTD ref: 00B039B6
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00B039CD

Part of subcall function 00B5CF3B: _Yarn.LIBCPMT ref: 00B5CF5A
Part of subcall function 00B5CF3B: _Yarn.LIBCPMT ref: 00B5CF7E

Strings

bad locale name, xrefs: 00B039D7

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Yarn$std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3904239083-1405518554
Opcode ID: a080b3db73d7cf7a1893d0dc4df62cf08c1871ae90a1d496eb4d568bfe6255e6
Instruction ID: 2891529a849d610255b6b001a2a7438780b4c8491e203554e5bee0ebedf776ee
Opcode Fuzzy Hash: a080b3db73d7cf7a1893d0dc4df62cf08c1871ae90a1d496eb4d568bfe6255e6
Instruction Fuzzy Hash: 98215EB090424ADBDF04EB98C955BBEBBB1AF44708F1445DCE5122B3C2CB755A04C7A5

Function 03952991 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 03952A7C

Strings

(null), xrefs: 03952B0D
(null), xrefs: 03952B87
0123456789ABCDEF, xrefs: 039529F8
0123456789abcdef, xrefs: 039529F1

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: (null)$(null)$0123456789ABCDEF$0123456789abcdef
API String ID: 1302938615-1267642376
Opcode ID: 5bb8c21de022740f5871df14db7b1a143e6a4e668ea9ac1ea884507fea03e9e9
Instruction ID: 4d5eba79ef91d7b8cbc39ebb6f13b24fd48ec536760d057789cf251a79d01820
Opcode Fuzzy Hash: 5bb8c21de022740f5871df14db7b1a143e6a4e668ea9ac1ea884507fea03e9e9
Instruction Fuzzy Hash: 799148716043028FDB25CF28C49062ABBE9EF86284F184D6EF8DA87651D770E9C1CB51

Function 00B632E1 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00B63400
___TypeMatch.LIBVCRUNTIME ref: 00B6350E
_UnwindNestedFrames.LIBCMT ref: 00B63660
CallUnexpected.LIBVCRUNTIME ref: 00B6367B

Strings

csm, xrefs: 00B6331E
csm, xrefs: 00B63437
csm, xrefs: 00B6338B

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: e5bdbe6d410aba3c5024c887ba221a1d9363c87d77e1cbf3e58e3d7211065c5c
Instruction ID: 36717015778504a7a965b4355f8d97557bc72b82712f047a3538678a85214fce
Opcode Fuzzy Hash: e5bdbe6d410aba3c5024c887ba221a1d9363c87d77e1cbf3e58e3d7211065c5c
Instruction Fuzzy Hash: F4B14671C00209EFCF15DFA4C8819AEBBF5FF18B10B1445AAE8126B212D739DA51CF95

Function 00B71338 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00B715B2, 00B715B7

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 6d009ef9af7de7937500d32205e263c236f950e6ea0a86bf071a84d393d026e3
Instruction ID: b6467f89a33f7583d16fcaf63e7d07c589bf461aac563ced4dc4987d89e3ad22
Opcode Fuzzy Hash: 6d009ef9af7de7937500d32205e263c236f950e6ea0a86bf071a84d393d026e3
Instruction Fuzzy Hash: 64B1DE70E04249ABDB159FACC881BAD7BF5EF55300F188598E42A9B392CB70D942CB74

Function 03951F2D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32 ref: 03951F90
GetKeyboardLayoutList.USER32(00000032,?), ref: 03951FF2

Strings

{%d} , xrefs: 03952025
), xrefs: 03952042
- SystemLayout %d, xrefs: 03951FCC
- KeyboardLayouts: ( , xrefs: 03951FDB

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: DefaultKeyboardLanguageLayoutListUser
String ID: )$- KeyboardLayouts: ( $- SystemLayout %d${%d}
API String ID: 167087913-619012376
Opcode ID: 74126a76061f1547a809cc550d7df12871171f8437605a7c5a33882f03488d5c
Instruction ID: 0af6b3d6d726f4c252c15698447be48c45241bb5a0a7a98e2287959433972537
Opcode Fuzzy Hash: 74126a76061f1547a809cc550d7df12871171f8437605a7c5a33882f03488d5c
Instruction Fuzzy Hash: 6C319F54E08298AAEB01DFE4A4017FDBB70EF14306F405496FD88FA282D7794B85C76A

Function 00B6DD94 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,D6504D6B,?,00B6DEA3,00000000,00B013A5,00000000,00000000), ref: 00B6DE55

Strings

ext-ms-, xrefs: 00B6DDFF
api-ms-, xrefs: 00B6DDEB

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 2af1f0070d9251994c32892ececc0782928ad48f16c4ea27d9775cd36c9b10ce
Instruction ID: 04abea74738f45196eeea929dacdd77a703add479dbb49d8c0b54614a99f0e5d
Opcode Fuzzy Hash: 2af1f0070d9251994c32892ececc0782928ad48f16c4ea27d9775cd36c9b10ce
Instruction Fuzzy Hash: A121EB31F00210BBCF319B65DC40A5B37D8EB657A0F1501A4E91AAB2E0DB35ED40CBE1

Function 00B5E516 Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5E51D
std::_Lockit::_Lockit.LIBCPMT ref: 00B5E527
int.LIBCPMTD ref: 00B5E53E

Part of subcall function 00B046D0: std::_Lockit::_Lockit.LIBCPMT ref: 00B046E6
Part of subcall function 00B046D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B04710

codecvt.LIBCPMT ref: 00B5E561
std::_Facet_Register.LIBCPMT ref: 00B5E578
std::_Lockit::~_Lockit.LIBCPMT ref: 00B5E598
Concurrency::cancel_current_task.LIBCPMTD ref: 00B5E5A5

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: 898592cf129465351b4076cfa596e80acb83afc521cfca55c63e664d7cb1ffce
Instruction ID: 4ad8154d99574aac053c40ec28be481c502c58247ef154a901f5ea139822219e
Opcode Fuzzy Hash: 898592cf129465351b4076cfa596e80acb83afc521cfca55c63e664d7cb1ffce
Instruction Fuzzy Hash: 8D1106B29102189FCB15AB64D8467AE7BF5FF84721F1004C9F815A7291EFB4DE05CB80

Function 00B5D7A8 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5D7AF
std::_Lockit::_Lockit.LIBCPMT ref: 00B5D7B9
int.LIBCPMTD ref: 00B5D7D0

Part of subcall function 00B046D0: std::_Lockit::_Lockit.LIBCPMT ref: 00B046E6
Part of subcall function 00B046D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B04710

codecvt.LIBCPMT ref: 00B5D7F3
std::_Facet_Register.LIBCPMT ref: 00B5D80A
std::_Lockit::~_Lockit.LIBCPMT ref: 00B5D82A
Concurrency::cancel_current_task.LIBCPMTD ref: 00B5D837

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: b96fdf26a2610f65b1c811f5329056fab73975573d98c32fb74e6c99a04f5099
Instruction ID: 6e52f41b6e7eb828422cf05cceae0d9fb4714a4c938bf94c52fb3f28f294f35e
Opcode Fuzzy Hash: b96fdf26a2610f65b1c811f5329056fab73975573d98c32fb74e6c99a04f5099
Instruction Fuzzy Hash: 4D01C07690021A9BCB15EBA09846BAE7BF2EF84311F2401C8E8116B291DF749E09C781

Function 00B5F8DE Relevance: 9.2, APIs: 6, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00B5F927
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00B5F992
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B5F9AF
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00B5F9EE
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B5FA4D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00B5FA70

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 1188f19213096a277a67a3ef07da2776035b50093165a8e1e3376728b2a4e64b
Instruction ID: 358c0986095e8d36f3b5d1d7360617748b9799b837de7a8d5314d56c4b02b5e5
Opcode Fuzzy Hash: 1188f19213096a277a67a3ef07da2776035b50093165a8e1e3376728b2a4e64b
Instruction Fuzzy Hash: A0518A7290020BABEF219FA4CC85FBBBBF9EB44741F1044E5FD09A6190DB748918CB91

Function 03953084 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

x, xrefs: 039533C4

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: dcc93f5783802aa8e0e0c0cdd65dad41de959ffbbb41cf6315bc881eb6a1d39f
Instruction ID: 7e5bd16dce1fc7c304a009cd080db5c405208dbe7202759bcfdfe20e05d089ac
Opcode Fuzzy Hash: dcc93f5783802aa8e0e0c0cdd65dad41de959ffbbb41cf6315bc881eb6a1d39f
Instruction Fuzzy Hash: BE02AE79E04249EFCB45CFA8C984AADB7F4FF09345F048856E866EB250D730AA91CF51

Function 00B62FAA Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B62FA1,00B616DC,00B60672), ref: 00B62FB8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B62FC6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B62FDF
SetLastError.KERNEL32(00000000,00B62FA1,00B616DC,00B60672), ref: 00B63031

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5f4bd1e586b73281ab2641ecdf6b020bcb47b6b4aab749f0539842f365b868ed
Instruction ID: 9d80e093d7c152e641460d970024fb81130a7f706f6d40ca6f5482000431ee2e
Opcode Fuzzy Hash: 5f4bd1e586b73281ab2641ecdf6b020bcb47b6b4aab749f0539842f365b868ed
Instruction Fuzzy Hash: 2201D83211DB226DB6252BB47D85B1B2AE5EB52B7073003BAF110620F0EF5D4C459245

Function 00B680CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,D6504D6B,?,?,00000000,00B78AEC,000000FF,?,00B680A8,?,?,00B6807C,00000000), ref: 00B68101
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B68113
FreeLibrary.KERNEL32(00000000,?,00000000,00B78AEC,000000FF,?,00B680A8,?,?,00B6807C,00000000), ref: 00B68135

Strings

mscoree.dll, xrefs: 00B680FA
CorExitProcess, xrefs: 00B6810B

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 84d0847dccf545fbfc25e40f10d83d0b99a80c89614614e10af4337d623a9292
Instruction ID: dbe0e4545d2fcc748f75298d77c583d5a0ab34eb18a1cb555bd7f66815b1e985
Opcode Fuzzy Hash: 84d0847dccf545fbfc25e40f10d83d0b99a80c89614614e10af4337d623a9292
Instruction Fuzzy Hash: 51016271954625EFDB119F54CC09FAFBBF9FB09B14F004669E825A32A0DF789940CA50

Function 00B01E20 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B01E40
int.LIBCPMTD ref: 00B01E59

Part of subcall function 00B046D0: std::_Lockit::_Lockit.LIBCPMT ref: 00B046E6
Part of subcall function 00B046D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B04710

Concurrency::cancel_current_task.LIBCPMTD ref: 00B01E99
std::_Lockit::~_Lockit.LIBCPMT ref: 00B01F01

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: a3e039e82170a94f0f49092ee8abc4ebbd11f8eadb88b877024b049454a4cecc
Instruction ID: 470046c05f202554f4286e274eb2ff4110f2a153837f9d1c89427d432c12afae
Opcode Fuzzy Hash: a3e039e82170a94f0f49092ee8abc4ebbd11f8eadb88b877024b049454a4cecc
Instruction Fuzzy Hash: 4D311AB1D00209DFCB04EF98D891BEEBBF1BB18310F204699E915673D1DB346A44CBA1

Function 00B01F20 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00B01F40
int.LIBCPMTD ref: 00B01F59

Part of subcall function 00B046D0: std::_Lockit::_Lockit.LIBCPMT ref: 00B046E6
Part of subcall function 00B046D0: std::_Lockit::~_Lockit.LIBCPMT ref: 00B04710

Concurrency::cancel_current_task.LIBCPMTD ref: 00B01F99
std::_Lockit::~_Lockit.LIBCPMT ref: 00B02001

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Concurrency::cancel_current_task
String ID:
API String ID: 3053331623-0
Opcode ID: 746c92182ca20c8901ce4c6b0d41a94fc01cdc2ac81c2a0ddc108d182b5e52b1
Instruction ID: 73311f691045b4377d5d1259436c70da724be4146594f7c691284b63278a752e
Opcode Fuzzy Hash: 746c92182ca20c8901ce4c6b0d41a94fc01cdc2ac81c2a0ddc108d182b5e52b1
Instruction Fuzzy Hash: 81312AB1D0020ADFCB04EFA8D881BEEBBF0BF08310F204699E51567391DB746A44CBA1

Function 00B5CE3D Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B5CE44
std::_Lockit::_Lockit.LIBCPMT ref: 00B5CE4F
std::_Lockit::~_Lockit.LIBCPMT ref: 00B5CEBD

Part of subcall function 00B5CFA0: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00B5CFB8

std::locale::_Setgloballocale.LIBCPMT ref: 00B5CE6A
_Yarn.LIBCPMT ref: 00B5CE80

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 997d2b8694f712e508cd282193c211348e087296540e658071a7a09ad2113aef
Instruction ID: b1fa56c41b6e088c4a98cf328bc2571acdf15760b4f42c20b45b8b40cbfa108c
Opcode Fuzzy Hash: 997d2b8694f712e508cd282193c211348e087296540e658071a7a09ad2113aef
Instruction Fuzzy Hash: E0015A75A102159FC705BB20D85AA7D7BB3BB88341B1440D9E8166B3A1CF78AE4ACBC5

Function 00B64072 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00B64023,00000000,?,00B8B824,?,?,?,00B641C6,00000004,InitializeCriticalSectionEx,00B7B270,InitializeCriticalSectionEx), ref: 00B6407F
GetLastError.KERNEL32(?,00B64023,00000000,?,00B8B824,?,?,?,00B641C6,00000004,InitializeCriticalSectionEx,00B7B270,InitializeCriticalSectionEx,00000000,?,00B63F7D), ref: 00B64089
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00B640B1

Strings

api-ms-, xrefs: 00B64096

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 946df6d8dc7834a22c2075f47174034888a9fcab348abcd34367933b8b5b520d
Instruction ID: a5fc2937129445aeb081382b282f4bc0cd3b6f8c3b6518c6a1f599e56e421cba
Opcode Fuzzy Hash: 946df6d8dc7834a22c2075f47174034888a9fcab348abcd34367933b8b5b520d
Instruction Fuzzy Hash: 35E01230684214BBDF201B60DC06F593AD5DB10B50F104060FE0CE50A1DBA6D8909ED5

Function 00B6F497 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(D6504D6B,00000000,00000000,00000000), ref: 00B6F4FA

Part of subcall function 00B71EBD: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B6EF8D,?,00000000,-00000008), ref: 00B71F1E

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00B6F74C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00B6F792
GetLastError.KERNEL32 ref: 00B6F835

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: eab0e76a5a52a6e0f39228ec56649a95bec1a7054c8ea0f69f64fa72abdd19d0
Instruction ID: b64aff18e63b5f8395e4fa81b57f1d113a999f2a56dc2a89b3efada6152cc8a3
Opcode Fuzzy Hash: eab0e76a5a52a6e0f39228ec56649a95bec1a7054c8ea0f69f64fa72abdd19d0
Instruction Fuzzy Hash: 1ED15975D00249DFCB15CFE8E8809ADBBF5FF09314F2445AAE826EB265D734A942CB50

Function 00B6308A Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00B63151
___AdjustPointer.LIBCMT ref: 00B63174
___AdjustPointer.LIBCMT ref: 00B63210

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: cf1f91e28feab081083a9a2191fcfacc50e72579b4c91b97de9a4406fdd804f3
Instruction ID: 467a4aba8d4cd41baf4e3ba2d1d0409f3921ab2c505fcba48e3c0e9a40c96919
Opcode Fuzzy Hash: cf1f91e28feab081083a9a2191fcfacc50e72579b4c91b97de9a4406fdd804f3
Instruction Fuzzy Hash: 9B513471A002069FDB288F15C891B7AB3E5EF05B00F1844EDEC06A72A1D73EEE45CB80

Function 00B7227A Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00B71EBD: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B6EF8D,?,00000000,-00000008), ref: 00B71F1E

GetLastError.KERNEL32 ref: 00B722DE
__dosmaperr.LIBCMT ref: 00B722E5
GetLastError.KERNEL32(?,?,?,?), ref: 00B7231F
__dosmaperr.LIBCMT ref: 00B72326

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: ee3866de56512153951335f0d4a2c1967f8bcf33646da7d5fa86210d56722638
Instruction ID: a902691475a6c59d423b14918257e98cd12e0d00d39363edd05b7ef19dccc589
Opcode Fuzzy Hash: ee3866de56512153951335f0d4a2c1967f8bcf33646da7d5fa86210d56722638
Instruction Fuzzy Hash: 6D21C271600705AFDB20AF65888186ABBEDEF04364B11C998F83D97242DB74ED5087A1

Function 00B67478 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2af5d3188ce06ee8b4c00aa7306fe217d47809ab65b86f850f9d21e1dd07923
Instruction ID: b70ea371d7291ccc9fca977be2839fed3febe1dce0957f500ba1749d283c75dd
Opcode Fuzzy Hash: f2af5d3188ce06ee8b4c00aa7306fe217d47809ab65b86f850f9d21e1dd07923
Instruction Fuzzy Hash: 4721C271648205AFDB20AF75D884C6A7BE9EF6036871085D4F91AD7250EF38ED5087A0

Function 00B7321E Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00B73226

Part of subcall function 00B71EBD: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00B6EF8D,?,00000000,-00000008), ref: 00B71F1E

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B7325E
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00B7327E

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 74668d422e28b4e37b7defbf6c8e588b60053d9922131b3b30850d2204c18dd8
Instruction ID: 6fd6d256afcb8d5c47ff61e027105075fb626c59a9dfa574d022ad63664af5c9
Opcode Fuzzy Hash: 74668d422e28b4e37b7defbf6c8e588b60053d9922131b3b30850d2204c18dd8
Instruction Fuzzy Hash: 5211C4B16025157FAB1137B55CCECAF29ECDE897A471045A4F81AE2102FE28CF41A571

Function 00B77C3B Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00B76B6B,00000000,00000001,0000000C,00000000,?,00B6F889,00000000,00000000,00000000), ref: 00B77C52
GetLastError.KERNEL32(?,00B76B6B,00000000,00000001,0000000C,00000000,?,00B6F889,00000000,00000000,00000000,00000000,00000000,?,00B6FE2C,?), ref: 00B77C5E

Part of subcall function 00B77C24: CloseHandle.KERNEL32(FFFFFFFE,00B77C6E,?,00B76B6B,00000000,00000001,0000000C,00000000,?,00B6F889,00000000,00000000,00000000,00000000,00000000), ref: 00B77C34

___initconout.LIBCMT ref: 00B77C6E

Part of subcall function 00B77BE6: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00B77C15,00B76B58,00000000,?,00B6F889,00000000,00000000,00000000,00000000), ref: 00B77BF9

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00B76B6B,00000000,00000001,0000000C,00000000,?,00B6F889,00000000,00000000,00000000,00000000), ref: 00B77C83

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 3eb21e963655849697171b654a45a798ca5544bd90c3d942e794db614cb28871
Instruction ID: de83bb58d2b82f0579a5f43d4bb92210fed3f7e004b4fc922351e5ac85b2dec6
Opcode Fuzzy Hash: 3eb21e963655849697171b654a45a798ca5544bd90c3d942e794db614cb28871
Instruction Fuzzy Hash: BBF0C036545115BBDF221FE5DC08D993F66FB497A1F058090FA1DA6530CE328960DB91

Function 03952C08 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 389COMMON

Download Yara Rule

APIs

Part of subcall function 03953508: EnterCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 03953512
Part of subcall function 03953508: GetProcessHeap.KERNEL32(00000008,00000208,?,?,039551B7), ref: 0395351B
Part of subcall function 03953508: RtlAllocateHeap.NTDLL(00000000,?,?,039551B7), ref: 03953522
Part of subcall function 03953508: LeaveCriticalSection.KERNEL32(039584D4,?,?,039551B7), ref: 0395352B

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000005,00000000,00000000), ref: 03952E3D

Strings

x, xrefs: 03952F32

Memory Dump Source

Source File: 00000009.00000002.2988116312.0000000003950000.00000040.00001000.00020000.00000000.sdmp, Offset: 03950000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_3950000_2DF0.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateByteCharEnterLeaveMultiProcessWide
String ID: x
API String ID: 1990697408-2363233923
Opcode ID: 4429037775c130750e19bc7accdae5069382771ea48f4bad6c28748f10561ba3
Instruction ID: 36a47cc24211c8f39a65a28ee7b6f254a063000e38f5afc28180e37859258a46
Opcode Fuzzy Hash: 4429037775c130750e19bc7accdae5069382771ea48f4bad6c28748f10561ba3
Instruction Fuzzy Hash: 4902AD75A04249EFCF01CFA8D984AAEBBF4BB09340F148895F895EB350D734AA81CF51

Function 00B6BBFD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00B6BC8D

Strings

pow, xrefs: 00B6BC65, 00B6BC82

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: f2c96bb7b84434486badead1c45478970d9b7f5d4d1a6a48b2e93e296200452c
Instruction ID: 639531d21e2c6f8d3033dd3d4500debc9a5f05b2a4f31e8a261d2f48684186de
Opcode Fuzzy Hash: f2c96bb7b84434486badead1c45478970d9b7f5d4d1a6a48b2e93e296200452c
Instruction Fuzzy Hash: CF513861A0410196CB117B14CD81B7A3FF4DB50B40F2049FDE4DAC72A9EF3D8DD5AA85

Function 00B62DB0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00B62DEF
__IsNonwritableInCurrentImage.LIBCMT ref: 00B62EA3

Strings

csm, xrefs: 00B62E8D

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 04dc450c987362a84218bd134da95cb4e89dba3e3fdc2b17ebed2958a47e7665
Instruction ID: 63edacd8460d86374dbd915be95fe5f109904937a010416dc7b03bd1cfc86a1f
Opcode Fuzzy Hash: 04dc450c987362a84218bd134da95cb4e89dba3e3fdc2b17ebed2958a47e7665
Instruction Fuzzy Hash: AB41A334E006099BDF10DF68C884A9EBBF5FF45714F1481E5E8186B3A2D73A9E15CB91

Function 00B63686 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00B636AB

Strings

MOC, xrefs: 00B636BD
RCC, xrefs: 00B636C5

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: e02fe01222fcd9dc71d3b1c26b6799949b0493741f2bb9cc25003d64bb3648bc
Instruction ID: a0d92fff74259a3de7a418385352dd8c915cd9809d7cc6adf3a49b2c1477c581
Opcode Fuzzy Hash: e02fe01222fcd9dc71d3b1c26b6799949b0493741f2bb9cc25003d64bb3648bc
Instruction Fuzzy Hash: D34138B1900209AFDF15DF98CD81EAEBBF5EF48700F184199FA0967251D339AE50DB50

Function 00B5C900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

Concurrency::task_continuation_context::task_continuation_context.LIBCPMTD ref: 00B5C9E8
task.LIBCPMTD ref: 00B5C9F6

Strings

}{cdef~hijkl/nopqrstuvwx|><B-DEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+, xrefs: 00B5C92A

Memory Dump Source

Source File: 00000009.00000002.2986837664.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000009.00000002.2986814497.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986886429.0000000000B79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986927576.0000000000B8A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986954804.0000000000B8B000.00000040.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000009.00000002.2986983960.0000000000B8C000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_b00000_2DF0.jbxd

Similarity

API ID: Concurrency::task_continuation_context::task_continuation_contexttask
String ID: }{cdef~hijkl/nopqrstuvwx|><B-DEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+
API String ID: 605201214-2946796713
Opcode ID: cc00c1c18aa83451d8692116bb6e81a18593325697619cb6074747d537746235
Instruction ID: 552b89ba910540f784911a72ffee08eb667125c76ad1ee3348e0f347beb93a2a
Opcode Fuzzy Hash: cc00c1c18aa83451d8692116bb6e81a18593325697619cb6074747d537746235
Instruction Fuzzy Hash: 0E31E671D042199FCB04DF98C991BEEBBF6FB48301F2041A9E815B7291DB756A04CBA0

Analysis Process: setup.exePID: 504, Parent PID: 352COMMON

Execution Graph

Execution Coverage:	17.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14%
Total number of Nodes:	1368
Total number of Limit Nodes:	27

Executed Functions

Function 004034CC Relevance: 94.9, APIs: 34, Strings: 20, Instructions: 417
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00008001), ref: 004034EF
GetVersionExA.KERNEL32(?), ref: 00403518
GetVersionExA.KERNEL32(0000009C), ref: 0040352F
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004035F8
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403635
OleInitialize.OLE32(00000000), ref: 0040363C
SHGetFileInfoA.SHELL32(0041FD10,00000000,?,00000160,00000000,?,00000007,00000009,0000000B), ref: 0040365A
GetCommandLineA.KERNEL32(00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 0040366F
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\setup.exe",00000020,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,00000007,00000009,0000000B), ref: 004036A9
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000007,00000009,0000000B), ref: 004037A2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 004037B3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037BF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 004037D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037DB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 004037EC
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004037F4
DeleteFileA.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403808
ExitProcess.KERNEL32(?,?,00000007,00000009,0000000B), ref: 004038AE
OleUninitialize.OLE32(?,?,00000007,00000009,0000000B), ref: 004038B3
ExitProcess.KERNEL32 ref: 004038D4
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038E7
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A1B0,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 004038F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\setup.exe",00000000,?,?,00000007,00000009,0000000B), ref: 00403901
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp), ref: 0040390D
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 00403929
DeleteFileA.KERNEL32(0041F910,0041F910,?,00425000,?,?,00000007,00000009,0000000B), ref: 00403986
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\setup.exe,0041F910,00000001), ref: 0040399B
CloseHandle.KERNEL32(00000000,0041F910,0041F910,?,0041F910,00000000,?,00000007,00000009,0000000B), ref: 004039C8
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000009,0000000B), ref: 004039F6
OpenProcessToken.ADVAPI32(00000000), ref: 004039FD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403A11
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00403A30
ExitWindowsEx.USER32(00000002,80040002), ref: 00403A55
ExitProcess.KERNEL32 ref: 00403A76

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403797, 0040379C, 004037B2, 004037BE, 004037CD, 004037DA, 004037E6, 004037EE, 004038E4, 004038F5, 00403900, 0040390C, 00403919, 00403928, 004039DD
", xrefs: 004036CC
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034E1
.tmp, xrefs: 004038FB
Low, xrefs: 004037D5
SeShutdownPrivilege, xrefs: 00403A0B
C:\Users\user\AppData\Local\Temp, xrefs: 00403906, 0040390B, 00403938
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00403996
A, xrefs: 0040356A
NSIS Error, xrefs: 00403660
TMP, xrefs: 004037EF
~nsu, xrefs: 004038DF
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403787, 00403886, 0040392F, 00403939
TEMP, xrefs: 004037E7
\Temp, xrefs: 004037B9
Error launching installer, xrefs: 0040386C
1033, xrefs: 00403803
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403891
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403675, 0040367B, 0040382A
UXTHEME, xrefs: 004035EC, 004035F1, 004035F7

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentPathTempTokenVariableVersionWindows$AdjustCharCloseCommandCopyErrorHandleInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesUninitializeValuelstrcmpilstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\setup.exe"$.tmp$1033$A$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2882342585-56685449
Opcode ID: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction ID: 1a4863036e4e50ed5e1acae1e6299f6db15da00d6e87979e5214c03ba8a99dba
Opcode Fuzzy Hash: 52eec0119052631d70130b9923c1eece19bfae2d8fd8cd18d56f0b379d03721e
Instruction Fuzzy Hash: 99E1D270A04354AADB21AF659D49B6F7EB89F86306F0540BFF441B61D2CB7C4A05CB2E

Function 00405B4A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405B73
lstrcatA.KERNEL32(00421D58,\*.*,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BBB
lstrcatA.KERNEL32(?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BDC
lstrlenA.KERNEL32(?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BE2
FindFirstFileA.KERNELBASE(00421D58,?,?,?,0040A014,?,00421D58,?,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405BF3
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405CA0
FindClose.KERNEL32(00000000), ref: 00405CB1

Strings

\*.*, xrefs: 00405BB5
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00405B53

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$\*.*
API String ID: 2035342205-2430568624
Opcode ID: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction ID: 9e5d3321e74a3647b1fb2cdcf4bec0a51507e3563529971eb59e862f6dba24c5
Opcode Fuzzy Hash: 2ba348f7f603991e7b2998a01f0f2af9ee039e7695cfc72fde993ee98a245b0d
Instruction Fuzzy Hash: 2B519130908B04AAEB316B61CC49BAF7AB8DF82755F14813FF851B51D2C73C5982DE69

Function 00406A88 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction ID: c2ee61ea0ab5e5811791f69f03c7ffba3fbd093a674906ee4b434ab4c587e2e9
Opcode Fuzzy Hash: b420139e1bb7bdc71f93166ff3cf2c8d4b4e2e8bf29b11b667125d81af8f4237
Instruction Fuzzy Hash: 0FF18A70D04269CBDF28CF98C8946ADBBB0FF44305F24816ED856BB281D7786A86DF45

Function 004066FF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(74DF3410,004225A0,C:\,00405E4B,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 0040670A
FindClose.KERNEL32(00000000), ref: 00406716

Strings

C:\, xrefs: 004066FF

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction ID: 083b1303d1f5dd1ba3b50291930e0491dd498af142a60d7bee4daa0eb941c193
Opcode Fuzzy Hash: a8a8e6ca181c7703a692eace486e77433675a7c42b8a8fe2eb47bb99df7a0189
Instruction Fuzzy Hash: B3D01231515120BBC3405B38AE0C95B7E589F093747618A36F066F22E4DB74CC6286AC

Function 00403B6E Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406794: GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
Part of subcall function 00406794: GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

lstrcatA.KERNEL32(1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403BE9
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,?,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,C:\Users\user\AppData\Roaming\GamePall,1033,00420D50,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420D50,00000000,00000002,74DF3410), ref: 00403C5E
lstrcmpiA.KERNEL32(?,.exe), ref: 00403C71
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403C7C
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\GamePall), ref: 00403CC5

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

RegisterClassA.USER32(00423EE0), ref: 00403D02
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403D1A
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403D4F
ShowWindow.USER32(00000005,00000000,?,"C:\Users\user\AppData\Local\Temp\setup.exe",00000009,0000000B), ref: 00403D85
GetClassInfoA.USER32(00000000,RichEdit20A,00423EE0), ref: 00403DB1
GetClassInfoA.USER32(00000000,RichEdit,00423EE0), ref: 00403DBE
RegisterClassA.USER32(00423EE0), ref: 00403DC7
DialogBoxParamA.USER32(?,00000000,00403F0B,00000000), ref: 00403DE6

Strings

.exe, xrefs: 00403C6B
RichEd32, xrefs: 00403D99
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73
.DEFAULT\Control Panel\International, xrefs: 00403BD4
>B, xrefs: 00403CD4
RichEdit, xrefs: 00403DB8
PB, xrefs: 00403B9A
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00403C2C, 00403C34, 00403C41, 00403C8B, 00403C91
Control Panel\Desktop\ResourceLocale, xrefs: 00403BA2
RichEd20, xrefs: 00403D8B
RichEdit20A, xrefs: 00403DA9, 00403DAF
_Nb, xrefs: 00403CE1, 00403D49
C:\Users\user\AppData\Roaming\GamePall, xrefs: 00403BF8, 00403C00, 00403C98, 00403C9E, 00403CAE
1033, xrefs: 00403B8E, 00403BE4
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00403B71

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Control Panel\Desktop\ResourceLocale$PB$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb$>B
API String ID: 1975747703-4005560175
Opcode ID: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction ID: 5836c5bb6a6ef8c4ff0aed12ec42ff3eebf2d58129c507535c8ab2622d1094a3
Opcode Fuzzy Hash: e590d0c5fa98f393744fb4f016bdb4800495c857999addaceec8a385476c3f6f
Instruction Fuzzy Hash: 4F61D670204200AED620AF65AD45F3B3A7CEB8574AF41453FF951B62E2CB7D9D028B6D

Function 00402F5C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F70
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\setup.exe,00000400), ref: 00402F8C

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

GetFileSize.KERNEL32(00000000,00000000,0042C000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00402FD5
GlobalAlloc.KERNEL32(00000040,00000009), ref: 00403117

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00402FB7, 00402FBC, 00402FC2
C:\Users\user\AppData\Local\Temp\setup.exe, xrefs: 00402F76, 00402F85, 00402F99, 00402FB6
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F66, 0040312F
soft, xrefs: 0040304A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403160
Null, xrefs: 00403053
Error launching installer, xrefs: 00402FAC
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 004031AE
Inst, xrefs: 00403041
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00402F65

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\setup.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-1937576205
Opcode ID: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction ID: 8a05da1d373fd2b3e089436e62a275652004ed3b6aa6cfe031be989f12afac8e
Opcode Fuzzy Hash: 948897f0a7bf445ed3fd87f3f97ca94f99971360adfd1b44ac20b9f0a6b79c08
Instruction Fuzzy Hash: 0771E231A01218ABDB20EF65DD85B9E7BACEB44356F10813BF910BA2C1D77C9E458B5C

Function 0040641B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400), ref: 00406549
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000400,?,00420530,00000000,004054E1,00420530,00000000), ref: 0040655C
SHGetSpecialFolderLocation.SHELL32(004054E1,00000000,?,00420530,00000000,004054E1,00420530,00000000), ref: 00406598
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 004065A6
CoTaskMemFree.OLE32(00000000), ref: 004065B2
lstrcatA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 004065D6
lstrlenA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530,00000000,004054E1,00420530,00000000,00000000,00000000,00000000), ref: 00406628

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004065D0
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406518
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406445, 00406515, 00406516, 00406517, 00406533, 00406548, 0040655B, 00406577, 004065A2, 004065D5, 004065DB, 004065F3, 00406606, 00406621, 00406627, 0040662F, 00406659

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2103940979
Opcode ID: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction ID: f38e20b3a3e0c1a2470d5ac0c6d90f06be75126661b475aa23e0086d5b044b98
Opcode Fuzzy Hash: 28fe3fa0c873c230fa859cbc890347587b683f5d94c1146f2a959db860f2b1f6
Instruction Fuzzy Hash: 9F612370900114AEDF205F24EC90BBA3BA4EB52314F52403FE913B62D1D37D8A62DB4E

Function 00401759 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00000000,00000000,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401786
C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe, xrefs: 00401826, 00401842
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$C:\Users\user\AppData\Roaming\GamePall\Uninstall.exe
API String ID: 1941528284-2333790722
Opcode ID: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction ID: 0d76be79c55a0237b493b10f9ec5be6125ba7ce9be49b25e4c886387d44134cc
Opcode Fuzzy Hash: 531cf43c35c58c4dd4a4f90f95c8ebf7c3fa560a9c590302947909e1ab3ecca7
Instruction Fuzzy Hash: E141B731900615BBCB107BB5CC45DAF3668EF45329B61833BF422F10E1D67C8A529AAE

Function 00406726 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
wsprintfA.USER32 ref: 00406776
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Strings

\, xrefs: 0040674E
%s%s.dll, xrefs: 00406770
UXTHEME, xrefs: 0040672F

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction ID: 0c3db372634d2cfba6f48721b0c795b31ebca02323a8b7d7371d162bf0ec7b9a
Opcode Fuzzy Hash: dd037f00298a2975fe7e642a10d0852ddcb34bcb2038a79f7270f2bd0b83f80d
Instruction Fuzzy Hash: FBF0FC7050021966DB15A764DD0DFEA365CAB08309F1404BEA586E20C1D6B8D5258B69

Function 004027E8 Relevance: 9.1, APIs: 6, Instructions: 91
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNELBASE(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402849
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402865
GlobalFree.KERNEL32(?), ref: 004028A4
GlobalFree.KERNEL32(00000000), ref: 004028B7
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028D3
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004028E6

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Global$AllocFree$ChangeCloseDeleteFileFindNotification
String ID:
API String ID: 2989416154-0
Opcode ID: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction ID: cd924008ac91bdcd896aacfcc8aadc4f9c7de1b4393fc14a433ce499bdbf1d56
Opcode Fuzzy Hash: 89df3cefb7dd421bed2d3b7eed546734cb5ae329452e645b4cc4e6c356db934a
Instruction Fuzzy Hash: D931AC32800128ABDF216FA5DE49D9E7A75FF08364F24423AF450B62D0CB7949419F68

Function 00405F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405F5E
GetTempFileNameA.KERNELBASE(0000000B,?,00000000,?,?,004034CA,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007), ref: 00405F78

Strings

nsa, xrefs: 00405F55
C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4D

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction ID: 05c77450f8afc2c62a5a11a921c51d956a1ea51751b09822177720344b0c8500
Opcode Fuzzy Hash: 6f67c72f8a62f6904c1c8d13d4c39cdc389fdf02a571d79ef00f96109094c4c4
Instruction Fuzzy Hash: 02F082363042087BDB109F55DD44BAB7B9CDF91750F14C03BFE48DA180D6B4D9988798

Function 004020A5 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 004020D0

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020E0
GetProcAddress.KERNEL32(00000000,?), ref: 004020F0
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040215A

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction ID: efc1da79dccaef9ffb2761d2644f5cd4432d5c2edc08e83b6cf0327c91c21bf2
Opcode Fuzzy Hash: 55027bfb1e7038bef75906a0c7732c3b75841ebb17574d5b7e2f6ee6ad6aef08
Instruction Fuzzy Hash: 2B210832904214E7CF207FA58E4DAAE3A60AF44358F60413FF601B61E0DBBD49819A6E

Function 00403A7C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403A8E
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,004038B3,?,?,00000007,00000009,0000000B), ref: 00403AA2

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A81
C:\Users\user\AppData\Local\Temp\nsjB8F5.tmp\, xrefs: 00403AB2

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsjB8F5.tmp\
API String ID: 2962429428-3666343344
Opcode ID: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction ID: f2bf129958ed6937e4157d035670f95a6da1e01cb45a681b65e96f9405f647bf
Opcode Fuzzy Hash: 860558c91a71a64e21cfc04441b923a48857e57a960d7bb4a44cdc910ceccc08
Instruction Fuzzy Hash: F4E08631640B1896C130EF7CAD4D8853B189B413357204726F1B9F20F0C738A9574EE9

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040596F: CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Roaming\GamePall,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00401631

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 1892508949-2308708932
Opcode ID: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction ID: f3b3600b6319d637c5497ea1020ed17c5aedac6227b62b2eaa768bc98e31f113
Opcode Fuzzy Hash: f3ba161a3ac08c4a0fb9ad52a50d0308f78dcdedc211e6075dac0401aebdcf48
Instruction Fuzzy Hash: 09115731508140EBCF306FA54D405BF23B09E96324B28453FF8D1B22E2DA3D0C42AA3E

Function 00405E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406388: lstrcpynA.KERNEL32(0000000B,0000000B,00000400,0040366F,00423F40,NSIS Error,?,00000007,00000009,0000000B), ref: 00406395

Part of subcall function 00405DB3: CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DC6
Part of subcall function 00405DB3: CharNextA.USER32(00000000), ref: 00405DDA

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405E5B
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0), ref: 00405E6B

Strings

C:\, xrefs: 00405E0E, 00405E13, 00405E19, 00405E54, 00405E5A, 00405E62, 00405E6A

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction ID: eca821d8ca18e415d707ee210574ba5bb9731226a542ad11e9256983d04766a4
Opcode Fuzzy Hash: 9b5a40e36fb6d6325312229f101030c034a2baba4673648e7d7a04b0a2ff685f
Instruction Fuzzy Hash: F7F02831105D5116C6223336AD09AAF1644CE9732471A453FFCE1B52D2DB3C8A539CEE

Function 00406EBD Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction ID: 14484b0326c8a5630d33184448731c7578348ec986130544f859662fecd3ad08
Opcode Fuzzy Hash: 3294aed7e6278100db64414b9f116292b07b09feaa7d8b5145f731feae0eba26
Instruction Fuzzy Hash: 04A12471E04229CBDF28CFA8C844BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 004070BE Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction ID: 16a3963220edad981734dfbd86db7ae4535d0e52bcc7a87e0ef86c627c8cfaa4
Opcode Fuzzy Hash: 74e067d77b8d7a9b68dd685dca04d3d71c5ee3b4c66787705bfaaaffb075589f
Instruction Fuzzy Hash: 2D912370D04268CBDF28CF98C854BADBBB1FF44305F14816AD956BB281C7786986DF45

Function 00406DD4 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction ID: e981be8a744509f315cfd76b32476d9c10b76e0a4aa84739a8d113cb33934a41
Opcode Fuzzy Hash: 7ffa2499bf387f79f1209cac769e5c71ba3d3f6d53411ba5d370abef73c06fe0
Instruction Fuzzy Hash: 37812471E04228CBDF24CFA8C844BADBBB1FF45305F24816AD856BB291C7789986DF45

Function 004068D9 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction ID: 8182d74baebb800b0d472bca2432a1a472ea96a2662ae7b36db949844af6c4d7
Opcode Fuzzy Hash: 9b20245c0637e97ad79b0c04fd837c43a33b4178456ec09291c35722496dfe88
Instruction Fuzzy Hash: DF815971E04228DBEF24CFA8C844BADBBB1FF44305F10816AD956BB281C7786986DF45

Function 00406D27 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction ID: 516ab04208dd2bc2fd7cdea6c41d3130492ff38fa800e35acf718bd73fbf6333
Opcode Fuzzy Hash: d628358dfeac25ccb8ac491a47a372453481bb06581bffe716440ea5054c50f9
Instruction Fuzzy Hash: A4712271E04228CBDF24CF98C844BADBBB1FF48305F14806AD856BB281C778A986DF45

Function 00406E45 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction ID: 835baf8de871759411e2c74e4a47f0112f02d54065241c3c7dcda5dc236b3f46
Opcode Fuzzy Hash: e8eb04bd933ca205c297744f59a7b7035fe2e59d11d29800bf5f20fbdb1e525a
Instruction Fuzzy Hash: 92712571E04228CBEF28CF98C844BADBBB1FF44305F15816AD856BB281C7786996DF45

Function 00406D91 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction ID: ccec74d0ee3a806077926e8984c2e201e8b1f3d886c73ab216be699138b2bca7
Opcode Fuzzy Hash: ed70085a56e3aedeea153169e26c1aa9cf9d7e4654945abbe59913f8bdc615b9
Instruction Fuzzy Hash: 39715771E04228CBEF28CF98C844BADBBB1FF44305F14806AD956BB281C778A946DF45

Function 00403305 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403319

Part of subcall function 00403484: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 0040334C
SetFilePointer.KERNELBASE(155C335B,00000000,00000000,004138F8,00004000,?,00000000,0040322F,00000004,00000000,00000000,0000000B,?,004031A9,000000FF,00000000), ref: 00403447

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction ID: 5f41a1ef9683aad456499e8308d87ccfcfa217f8aa92108fcff4f05b83e24891
Opcode Fuzzy Hash: f3fd145fe371a3aefb2ec72eaaf4336e3a5ddfe71b6918c4f9f269c5704fa6fa
Instruction Fuzzy Hash: 1F319F72A002059FC711BF2AFE849663BACE741356710C13BE814B62F0CB3859458FAD

Function 0040247E Relevance: 4.6, APIs: 3, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0040AC20,00000023,00000011,00000002), ref: 004024C9
RegSetValueExA.KERNELBASE(?,?,?,?,0040AC20,00000000,00000011,00000002), ref: 00402509
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseValuelstrlen
String ID:
API String ID: 2655323295-0
Opcode ID: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction ID: e1e6ae2a7b536448810537a1ffa9a52b32d6c636ce9630cd27147c6707bb0a71
Opcode Fuzzy Hash: ef8eeb58056491ee092ed80bef3546efe310264daaab0f586760f51b4d92765b
Instruction Fuzzy Hash: 04116371E04208AFEB10AFA5DE49AAEBA74EB84714F21443BF504F71C1DAB94D409B68

Function 00402590 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025C2
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 004025D5
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction ID: 33ff3e85e785963e302667c06a3cb1355a7acd8bf142a31c2560ef5bcfc7d759
Opcode Fuzzy Hash: 039baf7d42ae34e4e7f4f0d82c42536c565db7a64b10d6b3f593835efb4c20b6
Instruction Fuzzy Hash: 2C017571904104FFE7158F54DE88ABF7BACEF81358F20443EF101A61C0DAB44E449679

Function 00405B02 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405EF6: GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
Part of subcall function 00405EF6: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B1D
DeleteFileA.KERNELBASE(?,?,?,00000000,00405CF1), ref: 00405B25
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B3D

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction ID: eeb49a2f717892c2e0964ab94aaac89db2a73fdd151ed94c70539e0cf44bba43
Opcode Fuzzy Hash: fdbfe47bebcd8a5232fcae5ebebd8a359ed736e28fe734178b51a2620122945d
Instruction Fuzzy Hash: 6CE0E531109A9097C62067349908A5B7AF8EF86314F094D3AF9A1F20D0DB38B9468EBD

Function 004031FD Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0000000B,?,004031A9,000000FF,00000000,00000000,00000009,?), ref: 00403222

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction ID: 301e065564a74905a78554ad982773151ad037ba2d6e6f8d8cd401a7b941de18
Opcode Fuzzy Hash: 966fed337372371c4087f3b005d0b036fc883b56c67f04ec2e368497ceacb8e7
Instruction Fuzzy Hash: E2318D30200219FFDB109F95ED45A9A3FA8EB05755B20847EB914E61D0D738DB509FA9

Function 0040251E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 0040254E
RegCloseKey.KERNELBASE(?,?,?,0040AC20,00000000,00000011,00000002), ref: 004025ED

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction ID: 7c766f3f1fb2abd04e903467a79d83897fdaad9d0bba0580308fe752c8381985
Opcode Fuzzy Hash: 6617ca3d26eaa2170afdc71dc748124b2257766e2e1ea0df1a2f7a4cdc0ba340
Instruction Fuzzy Hash: 1B11BF71905205EFDB25CF64DA985AE7BB4AF11355F20483FE042B72C0D6B88A85DA1D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction ID: c6e23866af321c238b4b59365f681da1ab702c54c00e726fca3ee5b0521d1f72
Opcode Fuzzy Hash: 04d136d289144069680b1fecce7da664cc2fd5e0b622116f853907ec40370e1b
Instruction Fuzzy Hash: 5201D131B242109BE7194B38AE04B2A36A8E754315F51813AF851F61F1DB78CC129B4D

Function 00405A21 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
CloseHandle.KERNEL32(?), ref: 00405A57

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction ID: 70dcd79ab4e1e9e84cc9ba673cd08f466e07e48f17d85ed3475224309c024e1a
Opcode Fuzzy Hash: c3ebc3f9998ac015d8c7df4fd8e4914833f251e822556357c2f70f84276a4d27
Instruction Fuzzy Hash: A5E04FB4600209BFEB009B64ED09F7B77ACFB04244F808421BE40F2150D67899658A78

Function 00406794 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000000,?,0040360E,0000000B), ref: 004067A6
GetProcAddress.KERNEL32(00000000,?), ref: 004067C1

Part of subcall function 00406726: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040673D
Part of subcall function 00406726: wsprintfA.USER32 ref: 00406776
Part of subcall function 00406726: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040678A

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction ID: 2a593beb9babc16b4b5ae8275dbdfb46ef4ebf17ea7291b62b5d373670c31446
Opcode Fuzzy Hash: 6cfaa89c8510a3ae83a05a93334a7968bfc88d7e7cb527baf598ad9b980e56cb
Instruction Fuzzy Hash: B6E0863260421157D21067705E4897773ACAF94B54302043EF546F3144D7389C76966D

Function 00405F1B Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction ID: c1cd633b288b309c16b37b55694bd397a2d2f3fd27c3ea135bedd35eac3c4d3c
Opcode Fuzzy Hash: f7726857ad0760fd27b8592a290aaff25a5a689f9fd17e1a71efc27c39f42f7d
Instruction Fuzzy Hash: D9D09E31254602AFEF0D8F20DE16F2E7AA2EB84B00F11952CB682944E2DA715819AB19

Function 00405EF6 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,00405B0E,?,?,00000000,00405CF1,?,?,?,?), ref: 00405EFB
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405F0F

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction ID: 2a9487917742c73a52daa6fa2dda6e447083e2efb983b62a69771bacbdb33add
Opcode Fuzzy Hash: 7db639ec3fc6e9a5b47d3eb1dfb332e917e8410632ca84ceba79978e33b6a3d0
Instruction Fuzzy Hash: E3D0C972504422ABD2102728AE0889BBB55DB94271702CA35FDA5A26F1DB304C569A9C

Function 004059EC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004034BF,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004059F2
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405A00

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction ID: 42ce2bd36b25b14d2ed8d631edf33fc643f4c4eb5ed9af5e51ab4a49ffb09bba
Opcode Fuzzy Hash: 1ac3f182099991a074ef026cd112de1bb624e535cee62a6747cbed0a6cbac083
Instruction Fuzzy Hash: 9BC04C303145419AD6505B309F4DB177A54AB50741F51553A638AE01A0DA348465DD2D

Function 0040623C Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CEA,00000000,?,?), ref: 00406265

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction ID: 57b18be241489d6c3509c0f1b2cb500900bdd64e2c84313365475615acd8ae2e
Opcode Fuzzy Hash: f0170b29b94a961cdf0cc122a920c286c7e5b726b195fdee8f598fb45efbb6e4
Instruction Fuzzy Hash: 16E0E672010109BEDF196F50DD0AD7B371DEB04341F01492EF916D4091E6B5A9309734

Function 00405FC2 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,0040C475,0040B8F8,00403405,0040B8F8,0040C475,004138F8,00004000,?,00000000,0040322F,00000004), ref: 00405FD6

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: d5187e51ab0d96a1766449b5dbb93cac2cdd9e80b7d20ab2fc0b5d8c8d5322e8
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: 4AE0EC3221065BABDF109E659C04EEB7B6CEB05360F004437FA55E3150D675E8219BA4

Function 00405F93 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000009,00000000,00000000,00000000,00000000,004138F8,0040B8F8,00403481,00000009,00000009,00403385,004138F8,00004000,?,00000000,0040322F), ref: 00405FA7

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction ID: 61a6516da629700e98a59d605e8380186fb5f41ecf47873683bd74a9a2ef61d4
Opcode Fuzzy Hash: 416aeb435aa013431afb1a9c1c8b913c8d53da26c76a00aa22b400e2b7bce1d1
Instruction Fuzzy Hash: 8BE08C3220161EEBEF119E508C00AEBBB6CEB00360F004433FD25E3140E234E9218BA8

Function 00403484 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403182,?), ref: 00403492

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction ID: eadcf480fe67690f272c505b4903882a1233053cb438a9b9796e5ea94341b5dd
Opcode Fuzzy Hash: 3686d685932152b10745f2b752acc0f7a7db7aadca6958b8d51083a7e9476777
Instruction Fuzzy Hash: 25B09231140200AADA215F409E09F057B21AB94700F208424B244280F086712025EA0D

Function 00401F7B Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Part of subcall function 00405A21: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00422558,00000009,00000009,0000000B), ref: 00405A4A
Part of subcall function 00405A21: CloseHandle.KERNEL32(?), ref: 00405A57

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FC0

Part of subcall function 00406809: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040681A
Part of subcall function 00406809: GetExitCodeProcess.KERNEL32(?,?), ref: 0040683C

Part of subcall function 004062E6: wsprintfA.USER32 ref: 004062F3

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction ID: dce1314ccbc215d7d9c334b017be086f7c4cc40ba0f87dfe0d8145fd67a5eb82
Opcode Fuzzy Hash: b93a315dc59908fe351c40803e733eeda605d55301c746aa3fa59235fa4bc662
Instruction Fuzzy Hash: 2DF0B432A05121DBDB20BFA59EC49EEB2A4DF41318B25463FF502B21D1CB7C4D418A6E

Non-executed Functions

Function 004055E7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405646
GetDlgItem.USER32(?,000003EE), ref: 00405655
GetClientRect.USER32(?,?), ref: 00405692
GetSystemMetrics.USER32(00000002), ref: 00405699
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004056BA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004056CB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004056DE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004056EC
SendMessageA.USER32(?,00001024,00000000,?), ref: 004056FF
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405721
ShowWindow.USER32(?,00000008), ref: 00405735
GetDlgItem.USER32(?,000003EC), ref: 00405756
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405766
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040577F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040578B
GetDlgItem.USER32(?,000003F8), ref: 00405664

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

GetDlgItem.USER32(?,000003EC), ref: 004057A7
CreateThread.KERNEL32(00000000,00000000,Function_0000557B,00000000), ref: 004057B5
CloseHandle.KERNEL32(00000000), ref: 004057BC
ShowWindow.USER32(00000000), ref: 004057DF
ShowWindow.USER32(?,00000008), ref: 004057E6
ShowWindow.USER32(00000008), ref: 0040582C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405860
CreatePopupMenu.USER32 ref: 00405871
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405886
GetWindowRect.USER32(?,000000FF), ref: 004058A6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004058BF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004058FB
OpenClipboard.USER32(00000000), ref: 0040590B
EmptyClipboard.USER32 ref: 00405911
GlobalAlloc.KERNEL32(00000042,?), ref: 0040591A
GlobalLock.KERNEL32(00000000), ref: 00405924
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405938
GlobalUnlock.KERNEL32(00000000), ref: 00405951
SetClipboardData.USER32(00000001,00000000), ref: 0040595C
CloseClipboard.USER32 ref: 00405962

Strings

PB, xrefs: 004058D7

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: PB
API String ID: 590372296-3196168531
Opcode ID: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction ID: 44a2cb424ceca129f1c721a27905a8e57bc1109532c064cce4e419f7e60c3497
Opcode Fuzzy Hash: 463c74343dc9a7e994e8db0b260deb87a45ca3f66d4da0101cb89f9be381629f
Instruction Fuzzy Hash: 18A13971900608FFDB11AF64DE85AAE7BB9FB48355F00403AFA41BA1A0CB754E51DF58

Function 00404897 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004048E6
SetWindowTextA.USER32(00000000,?), ref: 00404910
SHBrowseForFolderA.SHELL32(?,00420128,?), ref: 004049C1
CoTaskMemFree.OLE32(00000000), ref: 004049CC
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420D50), ref: 004049FE
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe), ref: 00404A0A
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404A1C

Part of subcall function 00405A82: GetDlgItemTextA.USER32(?,?,00000400,00404A53), ref: 00405A95

Part of subcall function 00406666: CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
Part of subcall function 00406666: CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
Part of subcall function 00406666: CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
Part of subcall function 00406666: CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

GetDiskFreeSpaceA.KERNEL32(0041FD20,?,?,0000040F,?,0041FD20,0041FD20,?,00000001,0041FD20,?,?,000003FB,?), ref: 00404ADA
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404AF5

Part of subcall function 00404C4E: lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
Part of subcall function 00404C4E: wsprintfA.USER32 ref: 00404CF4
Part of subcall function 00404C4E: SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

PB, xrefs: 00404994
C:\Users\user\AppData\Roaming\GamePall, xrefs: 004049E7
A, xrefs: 004049BA
C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 004049F8, 004049FD, 00404A08

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Roaming\GamePall$C:\Users\user\AppData\Roaming\GamePall\GamePall.exe$PB
API String ID: 2624150263-3665957329
Opcode ID: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction ID: 03633cdec68ae3b48ba4c7d33c4768738bfb21d85bfcf2e4b9185cba9ee35c0f
Opcode Fuzzy Hash: 246729fcc772db5bb1fe110679472811f76dfb67008edee7d622b3e588ee8d40
Instruction Fuzzy Hash: 7DA150B1A00208AADB11EFA5DD45BAFB6B8EF84315F10803BF601B62D1D77C99418F6D

Function 00402173 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408418,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00408408,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004022AA

Strings

C:\Users\user\AppData\Roaming\GamePall, xrefs: 00402238

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Roaming\GamePall
API String ID: 123533781-2308708932
Opcode ID: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction ID: 4a55140eb955682c0845ac661669d1effe53c60cfc8a987c49de3bb9103baba8
Opcode Fuzzy Hash: 975ab102bccf2e3ea3487b48f3b75e49990d828168e5a332ce340ef805c2210c
Instruction Fuzzy Hash: B2513575A00208AFDF10DFE4CA88A9D7BB5EF48314F2045BAF505EB2D1DA799981CB54

Function 00404E0A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 491windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E21
GetDlgItem.USER32(?,00000408), ref: 00404E2E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404E7D
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404E94
SetWindowLongA.USER32(?,000000FC,0040541D), ref: 00404EAE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404EC0
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404ED4
SendMessageA.USER32(?,00001109,00000002), ref: 00404EEA
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404EF6
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F06
DeleteObject.GDI32(00000110), ref: 00404F0B
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404F36
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404F42
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404FDC
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 0040500C

Part of subcall function 0040443A: SendMessageA.USER32(00000028,?,00000001,0040426A), ref: 00404448

SendMessageA.USER32(?,00001100,00000000,?), ref: 00405020
GetWindowLongA.USER32(?,000000F0), ref: 0040504E
SetWindowLongA.USER32(?,000000F0,00000000), ref: 0040505C
ShowWindow.USER32(?,00000005), ref: 0040506C
SendMessageA.USER32(?,00000419,00000000,?), ref: 00405167
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004051CC
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 004051E1
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405205
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405225
ImageList_Destroy.COMCTL32(?), ref: 0040523A
GlobalFree.KERNEL32(?), ref: 0040524A
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004052C3
SendMessageA.USER32(?,00001102,?,?), ref: 0040536C
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 0040537B
InvalidateRect.USER32(?,00000000,00000001), ref: 004053A6
ShowWindow.USER32(?,00000000), ref: 004053F4
GetDlgItem.USER32(?,000003FE), ref: 004053FF
ShowWindow.USER32(00000000), ref: 00405406

Strings

, xrefs: 004053DE
N, xrefs: 004050A5
M, xrefs: 00404FC4

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction ID: c306c4130ea67d8582adb4b0d0e706bf782d7aff15223233fd0d43401108afdf
Opcode Fuzzy Hash: 4bb258af210f6716591e45ffd85afba0d9fc7d499c01c39e68e435e5f0500988
Instruction Fuzzy Hash: 6C025CB0A00609AFDB209F94DD45AAE7BB5FB84354F10817AF610BA2E1D7789D42CF58

Function 00403F0B Relevance: 61.6, APIs: 34, Strings: 1, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403F47
ShowWindow.USER32(?), ref: 00403F67
GetWindowLongA.USER32(?,000000F0), ref: 00403F79
ShowWindow.USER32(?,00000004), ref: 00403F92
DestroyWindow.USER32 ref: 00403FA6
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403FBF
GetDlgItem.USER32(?,?), ref: 00403FDE
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403FF2
IsWindowEnabled.USER32(00000000), ref: 00403FF9
GetDlgItem.USER32(?,00000001), ref: 004040A4
GetDlgItem.USER32(?,00000002), ref: 004040AE
SetClassLongA.USER32(?,000000F2,?), ref: 004040C8
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00404119
GetDlgItem.USER32(?,00000003), ref: 004041BF
ShowWindow.USER32(00000000,?), ref: 004041E0
EnableWindow.USER32(?,?), ref: 004041F2
EnableWindow.USER32(?,?), ref: 0040420D
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00404223
EnableMenuItem.USER32(00000000), ref: 0040422A
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00404242
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00404255
lstrlenA.KERNEL32(00420D50,?,00420D50,00000000), ref: 0040427F
SetWindowTextA.USER32(?,00420D50), ref: 0040428E
ShowWindow.USER32(?,0000000A), ref: 004043C2

Strings

PB, xrefs: 0040426F

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID: PB
API String ID: 1860320154-3196168531
Opcode ID: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction ID: 6b3c419a8b2de2434844e8cd53afab52d63163afb5b1bd925d395a768d9dd0e6
Opcode Fuzzy Hash: a84a76c7c437068317dea6ec38f5a19867a10701d7094664a652b1a8aea3850c
Instruction Fuzzy Hash: ECC1D2B1A00204BBCB206F61EE45E2B3A78EB85745F41053EF781B61F1CB3998929B5D

Function 00404570 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 202windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004045FB
GetDlgItem.USER32(00000000,000003E8), ref: 0040460F
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040462D
GetSysColor.USER32(?), ref: 0040463E
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 0040464D
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 0040465C
lstrlenA.KERNEL32(?), ref: 0040465F
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 0040466E
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404683
GetDlgItem.USER32(?,0000040A), ref: 004046E5
SendMessageA.USER32(00000000), ref: 004046E8
GetDlgItem.USER32(?,000003E8), ref: 00404713
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404753
LoadCursorA.USER32(00000000,00007F02), ref: 00404762
SetCursor.USER32(00000000), ref: 0040476B
LoadCursorA.USER32(00000000,00007F00), ref: 00404781
SetCursor.USER32(00000000), ref: 00404784
SendMessageA.USER32(00000111,00000001,00000000), ref: 004047B0
SendMessageA.USER32(00000010,00000000,00000000), ref: 004047C4

Strings

N, xrefs: 00404701
6B, xrefs: 0040476F

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$6B
API String ID: 3103080414-649610290
Opcode ID: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction ID: 424ea1d81b5f8fd67bb79b8421ee67f108f717641e3cc5fc4ea293435da972af
Opcode Fuzzy Hash: c874497606b373bfbb3475a273ba326ab034ae9c38f8566fe8320349c510c150
Instruction Fuzzy Hash: CE6190B1A40208BFDB109F61DD45B6A7B69FB84715F10843AFB01BB2D1C7B8A951CF98

Function 00405FF1 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 129memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00406182,?,?), ref: 00406022
GetShortPathNameA.KERNEL32(?,00422AE0,00000400), ref: 0040602B

Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
Part of subcall function 00405E80: lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

GetShortPathNameA.KERNEL32(?,00422EE0,00000400), ref: 00406048
wsprintfA.USER32 ref: 00406066
GetFileSize.KERNEL32(00000000,00000000,00422EE0,C0000000,00000004,00422EE0,?,?,?,?,?), ref: 004060A1
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060B0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060E8
SetFilePointer.KERNEL32(0040A3F0,00000000,00000000,00000000,00000000,004226E0,00000000,-0000000A,0040A3F0,00000000,[Rename],00000000,00000000,00000000), ref: 0040613E
GlobalFree.KERNEL32(00000000), ref: 0040614F
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406156

Part of subcall function 00405F1B: GetFileAttributesA.KERNELBASE(00000003,00402F9F,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405F1F
Part of subcall function 00405F1B: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405F41

Strings

%s=%s, xrefs: 0040605C
.B, xrefs: 0040603D
*B, xrefs: 00406010
.B, xrefs: 00406044
[Rename], xrefs: 004060D0, 004060E2

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]$*B$.B$.B
API String ID: 2171350718-3836630945
Opcode ID: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction ID: 7566a5a9e9d08134d14435fb5d3e1561ad96112206bac95af022f508aac3f812
Opcode Fuzzy Hash: 2ac8773abaa14c2605e43abf0f292608002e21a2c197761b550c40717a00d302
Instruction Fuzzy Hash: 68310531200715BBC2207B659D49F6B3A5DDF85754F15003EFE42BA2C3EA7CD8228AAD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00423F40,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction ID: bc851ab26da2bb863bf3a2ee07eb2f950de800ada4cbee7b2d64f78586a04119
Opcode Fuzzy Hash: db458c2aac7b07c9de4f1dfd54ee4cc10e0d46da2aaa9c20a0cc65b716daa4c3
Instruction Fuzzy Hash: 2C419D71800249AFCF058FA5DE459AF7FB9FF45314F00802AF991AA1A0C734DA55DFA4

Function 004054A9 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
SetWindowTextA.USER32(00420530,00420530), ref: 00405517
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

Strings

4/@, xrefs: 004054EF, 00405501

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: 4/@
API String ID: 2531174081-3101945251
Opcode ID: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction ID: 7ab3267fb946cf8e7efc5916356ec1270af3577e2396c2c3629ce5ef3fcb69de
Opcode Fuzzy Hash: 17623ae6e76ffa783ca229a28a88b1e205e4a8d30cb80da27a9000df8195634c
Instruction Fuzzy Hash: 0F217A71E00118BBCF119FA5DD8099EBFB9EF09354F04807AF944A6291C7788A90CFA8

Function 00406666 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(0000000B,*?|<>/":,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066BE
CharNextA.USER32(0000000B,0000000B,0000000B,00000000,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066CB
CharNextA.USER32(0000000B,?,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066D0
CharPrevA.USER32(0000000B,0000000B,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\setup.exe",004034A7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 004066E0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406667
"C:\Users\user\AppData\Local\Temp\setup.exe", xrefs: 00406666
*?|<>/":, xrefs: 004066AE

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\setup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1678727643
Opcode ID: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction ID: 80d428334b402c3338f843ea799862c1973996ffb1638880579f4ae0c72fc655
Opcode Fuzzy Hash: 6bc0e94b7f234696628355ee2fbbbdde5b7464ab094feb853247d74dffcc646e
Instruction Fuzzy Hash: 7E1108518047902DEB3206340C04B7B7F894F977A0F2A087FD8C6722C2D67E5C62967D

Function 00402EBD Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402ED5
GetTickCount.KERNEL32 ref: 00402EF3
wsprintfA.USER32 ref: 00402F21

Part of subcall function 004054A9: lstrlenA.KERNEL32(00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000,?), ref: 004054E2
Part of subcall function 004054A9: lstrlenA.KERNEL32(4/@,00420530,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402F34,00000000), ref: 004054F2
Part of subcall function 004054A9: lstrcatA.KERNEL32(00420530,00000020,4/@,00420530,00000000,00000000,00000000), ref: 00405505
Part of subcall function 004054A9: SetWindowTextA.USER32(00420530,00420530), ref: 00405517
Part of subcall function 004054A9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040553D
Part of subcall function 004054A9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405557
Part of subcall function 004054A9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405565

CreateDialogParamA.USER32(0000006F,00000000,00402E25,00000000), ref: 00402F45
ShowWindow.USER32(00000000,00000005), ref: 00402F53

Part of subcall function 00402EA1: MulDiv.KERNEL32(00000000,00000064,0000D822), ref: 00402EB6

Strings

... %d%%, xrefs: 00402F1B
#Vh%.@, xrefs: 00402F34

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%$#Vh%.@
API String ID: 722711167-1706192003
Opcode ID: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction ID: ac0ca11ee9366edb0cc6a28cc5aeb329eacd7d00ab00b3c3670f6d564c8935e4
Opcode Fuzzy Hash: db62a3d36480f0b73892ce8a9fc69f21d0c49374a29e778f3850d420ffd5c07d
Instruction Fuzzy Hash: 3F01A170542225EBCB21BB50EF0CBAB3778EB40744B04443BF505B21D0C7F894469AEE

Function 0040446C Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404489
GetSysColor.USER32(00000000), ref: 004044C7
SetTextColor.GDI32(?,00000000), ref: 004044D3
SetBkMode.GDI32(?,?), ref: 004044DF
GetSysColor.USER32(?), ref: 004044F2
SetBkColor.GDI32(?,?), ref: 00404502
DeleteObject.GDI32(?), ref: 0040451C
CreateBrushIndirect.GDI32(?), ref: 00404526

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction ID: 76b6fc4927f6120469f5ffa52701fcd3ddd76896e52d32ad6f55637f73cee333
Opcode Fuzzy Hash: d8b0c4ae085d5752a0ceb3fd9c96bfdfa4daadee6b5f884e1a531c3ceae13210
Instruction Fuzzy Hash: 9E2147B1501704AFCB31DF68ED08B5BBBF8AF41715B04892EEA96A26E0D734E904CB54

Function 00404D58 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404D73
GetMessagePos.USER32 ref: 00404D7B
ScreenToClient.USER32(?,?), ref: 00404D95
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404DA7
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404DCD

Strings

f, xrefs: 00404DA9

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction ID: de178be9688f757f82ef56a4cbeb6693d0582b60b2ea90e1a00f6814b48fd044
Opcode Fuzzy Hash: fae6ee4ef260730fd0e6baeb46c05ac4d0d99299cd6b7910a3b5b88b2e21feb9
Instruction Fuzzy Hash: BB014871900219BADB01DBA4DD85BFEBBF8AF95B11F10016ABA40B61C0C6B499058BA4

Function 0040596F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,0000000B,C:\Users\user\AppData\Local\Temp\), ref: 004059B2
GetLastError.KERNEL32 ref: 004059C6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004059DB
GetLastError.KERNEL32 ref: 004059E5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405995
!9@, xrefs: 00405984

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: !9@$C:\Users\user\AppData\Local\Temp\
API String ID: 3449924974-2369717338
Opcode ID: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction ID: 4cd508ff09270142ca7a6984d66ae253fefa4e1f6983b248f3af4f59f5a14231
Opcode Fuzzy Hash: df2ca303ac227c9e0d0fbc5e27afd1aa0bff8a01fb2d8cf1edb312bec269ebc1
Instruction Fuzzy Hash: 610108B1D00259DAEF109BA0CA45BEFBBB8EB04354F00403AD645B6290D7789648CF99

Function 00402E25 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E40
wsprintfA.USER32 ref: 00402E74
SetWindowTextA.USER32(?,?), ref: 00402E84
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402E96

Strings

verifying installer: %d%%, xrefs: 00402E69, 00402E72
unpacking data: %d%%, xrefs: 00402E62

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction ID: 7ad4584a5e884be7344c254f70e0401137e7e46ce86c3cf658bb2ab9d23be74a
Opcode Fuzzy Hash: a45d99d8fe85d32cf27a6b993dcd334edf2177b7a3e8b64a3b444c48cc752336
Instruction Fuzzy Hash: 1DF01D7054020DBAEF219F60DE0ABAE3769EB44344F00803AFA16B91D0DBB899558F99

Function 00404C4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420D50,00420D50,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404B69,000000DF,00000000,00000400,?), ref: 00404CEC
wsprintfA.USER32 ref: 00404CF4
SetDlgItemTextA.USER32(?,00420D50), ref: 00404D07

Strings

%u.%u%s%s, xrefs: 00404CD6
PB, xrefs: 00404CDE

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$PB
API String ID: 3540041739-838025833
Opcode ID: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction ID: 635705270cf82d3fa6c033b13715314544988666452c3f341a93ad76d23c3d90
Opcode Fuzzy Hash: 837710c020be2e613de14c6f4d6baa8c213068046cd931f6ce14c5213cbfad60
Instruction Fuzzy Hash: 5F11E77360512837EB00656D9D45EAE3298DB85374F26423BFE26F71D1E978CC1286E8

Function 00402D3B Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402D8F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402DDB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DE4
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402DFB
RegCloseKey.ADVAPI32(?,?,?), ref: 00402E06

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction ID: 1f7d8097ab2fb743d310579a2b4365e3e31c1a4ec17ce584dda370d325fd3950
Opcode Fuzzy Hash: e74c2f698c9890700b4790f2c47d05d8785518f345c631b22f69380fd2d26fe8
Instruction Fuzzy Hash: 1D214B7150010CBBDF129F90CE89EEB7B7DEF44344F11007AF955B11A0D7B49EA49AA8

Function 00401D65 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D7E
GetClientRect.USER32(?,?), ref: 00401DCC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DFC
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401E10
DeleteObject.GDI32(00000000), ref: 00401E20

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction ID: cb7cd4706ec086029cb46641885d9617bace417a5341e65c45b3777010ef1041
Opcode Fuzzy Hash: 593d1372a554d47c5dd87fed6cfd69f5edd78a04abfcab04570fffcca4b878a5
Instruction Fuzzy Hash: 35212A72E00109AFDF15DFA4DD85AAEBBB5EB88300F24417EF911F62A0DB389941DB14

Function 00401E35 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E38
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E52
MulDiv.KERNEL32(00000000,00000000), ref: 00401E5A
ReleaseDC.USER32(?,00000000), ref: 00401E6B
CreateFontIndirectA.GDI32(0040B820), ref: 00401EBA

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction ID: bfe7ce59390996d5b2ac71ca67757b7c78ff13e1b53bdd881068f9c0e557254e
Opcode Fuzzy Hash: de4b304c9a389d7a08c3fe75b8b690b37b20fc1cb77e4e41693a04eab2cef683
Instruction Fuzzy Hash: 66018072504340AEE7007BB0AF8AA9A7FE8E755701F109439F241B61E2CB790449CB6C

Function 00401C2E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C9E
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401CB6

Strings

!, xrefs: 00401C6A

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction ID: a12cfbdd51ff26f17676da16b1bc06906883597644a76ef85f46b7bf1251d8d3
Opcode Fuzzy Hash: 1399452274c26c04b05c3e26325e61428879637001adb01d26c94ca9c19498ca
Instruction Fuzzy Hash: 2A218271948208BEEB059FF5DA8AAAD7FB4EF84304F20447EF101B61D1D7B989819B18

Function 00405D1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D20
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004034B9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004037A9,?,00000007,00000009,0000000B), ref: 00405D29
lstrcatA.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405D3A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D1A

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction ID: 6a6775ee8fa4d5d8d60a890cb1840bbff54d6a4bc9e312217f61a2b57c53a4e0
Opcode Fuzzy Hash: 78cba1d5cb2474798914f87c9b537ab1510ee16986e2efd06177e80df85e38b2
Instruction Fuzzy Hash: 82D0A7625015307AD20167154C09DDF29488F523017094027F501B7191C67C5C1187FD

Function 00405DB3 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,0000000B,00405E1F,C:\,C:\,74DF3410,?,74DF2EE0,00405B6A,?,74DF3410,74DF2EE0,"C:\Users\user\AppData\Local\Temp\setup.exe"), ref: 00405DC1
CharNextA.USER32(00000000), ref: 00405DC6
CharNextA.USER32(00000000), ref: 00405DDA

Strings

C:\, xrefs: 00405DB4

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction ID: a81d310af092f64b8c374c4571b8fed5a60269d48026fa3bbeeaae68e06855d2
Opcode Fuzzy Hash: 39b5ed16b6dfe77c974b4e4dad13ac827778716fd50118a58326aa52b160bb8b
Instruction Fuzzy Hash: 71F09661904F542BFB3293648C4CB776B8DCF55351F28947BE6807A6C1C27C59808FEA

Function 0040541D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040544C
CallWindowProcA.USER32(?,?,?,?), ref: 0040549D

Part of subcall function 00404451: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00404463

Strings

, xrefs: 0040542D

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction ID: ce4d6245f7a5538c18ae28323cba1b5bdda0ccdff68052f186ad3da5f1ae13b7
Opcode Fuzzy Hash: 14b3d6ef5c2a84fc52750bef5e2e8b29c93878db9a0e482e1958f3e7559ce471
Instruction Fuzzy Hash: 2A015E31200608AFDF216F51DD80BAF3A66EB84716F104537FA05761D2C7799CD29F6A

Function 0040626F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,00000400,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,00420530,?,?,?,00000002,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00406527,80000002), ref: 004062B5
RegCloseKey.ADVAPI32(?,?,00406527,80000002,Software\Microsoft\Windows\CurrentVersion,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,C:\Users\user\AppData\Roaming\GamePall\GamePall.exe,?,00420530), ref: 004062C0

Strings

C:\Users\user\AppData\Roaming\GamePall\GamePall.exe, xrefs: 00406272, 004062A6

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CloseQueryValue
String ID: C:\Users\user\AppData\Roaming\GamePall\GamePall.exe
API String ID: 3356406503-2798812489
Opcode ID: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction ID: 5c8aa4f59809ec7c4ed175be077f356401e74c3ba082423fbe1b6bbc42bea5f4
Opcode Fuzzy Hash: 2abccbe21afdcf7b2969046f12d50590a05fc3777738c5024e31ebbb51756706
Instruction Fuzzy Hash: 8101BC72100209ABDF229F60CC09FDB3FA8EF45364F01407AFD56A6190D638C974CBA8

Function 00405D61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D67
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402FC8,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\setup.exe,C:\Users\user\AppData\Local\Temp\setup.exe,80000000,00000003), ref: 00405D75

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00405D61

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-47812868
Opcode ID: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction ID: 27c40c0738421aba4af956c8f0f705930dfe744a77a65273bf6dbb66402e0641
Opcode Fuzzy Hash: 46bbde6159133eac16457addd6c3fa88623ef59ff022f94c34d6ba2180d3974b
Instruction Fuzzy Hash: CBD0A772409D706EE31353208C04B8F6A48CF13300F0D4063E481A6190C2785C424BFD

Function 00405E80 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E90
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405EA8
CharNextA.USER32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EB9
lstrlenA.KERNEL32(00000000,?,00000000,004060DB,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405EC2

Memory Dump Source

Source File: 0000000B.00000002.3523368608.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.3523060350.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523551626.0000000000408000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000040A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.0000000000422000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3523605136.000000000042A000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.3524133826.000000000042E000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_setup.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction ID: 98ea32bb50e75ca8be10b873c57fc005eda9f523d07111d413316ed06cfa332a
Opcode Fuzzy Hash: 2d92a05f35b020f23b5ffca9bb537fc612b2b61cfc11000e71e0c2b875cbb8c3
Instruction Fuzzy Hash: 5FF06235104918AFCB129BA5DD4099EBFA8EF55350B2540B9E880F7211D674DF019BA9

Analysis Process: GamePall.exePID: 6348, Parent PID: 4484COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1100
Total number of Limit Nodes:	12

Executed Functions

Function 6047DC00 Relevance: 44.6, APIs: 2, Strings: 23, Instructions: 898COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 6047DD72
_strlen.LIBCMT ref: 6047DEB9

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h, xrefs: 6047E9D4
larg, xrefs: 6047E4B5
S, xrefs: 6047EDAC
CEF_CRASH_REPORTER_SERVER_URL, xrefs: 6047DC7D
__s should never be greater than or equal to the short string capacity, xrefs: 6047EA77
[Con, xrefs: 6047DFA1
%s:%d: assertion %s failed: %s, xrefs: 6047EA8B
char_traits::copy overlapped range, xrefs: 6047E9C5
..\..\third_party\libc++\src\include\string_view, xrefs: 6047EAAF
crash_reporter.cfg, xrefs: 6047EA52
,, xrefs: 6047E731
__s2 < __s1 || __s2 >= __s1+__n, xrefs: 6047E9CA
CEF_CRASH_REPORTER_RATE_LIMIT_ENABLED, xrefs: 6047DCA5
smal, xrefs: 6047E49D
..\..\third_party\libc++\src\include\string, xrefs: 6047EA86
medi, xrefs: 6047E4EA
__s < __min_cap, xrefs: 6047EA7C
__len <= static_cast<size_type>(numeric_limits<difference_type>::max()), xrefs: 6047EAA5
[CrashKeys], xrefs: 6047E00E
string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 6047EAB6
__len == 0 || __s != nullptr, xrefs: 6047EABB
string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 6047EAA0
fig], xrefs: 6047DFAB

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: FileModuleName_strlen
String ID: %s:%d: assertion %s failed: %s$,$..\..\third_party\libc++\src\include\__string\char_traits.h$..\..\third_party\libc++\src\include\string$..\..\third_party\libc++\src\include\string_view$CEF_CRASH_REPORTER_RATE_LIMIT_ENABLED$CEF_CRASH_REPORTER_SERVER_URL$S$[Con$[CrashKeys]$__len <= static_cast<size_type>(numeric_limits<difference_type>::max())$__len == 0 || __s != nullptr$__s < __min_cap$__s should never be greater than or equal to the short string capacity$__s2 < __s1 || __s2 >= __s1+__n$char_traits::copy overlapped range$crash_reporter.cfg$fig]$larg$medi$smal$string_view::string_view(_CharT *, size_t): length does not fit in difference_type$string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 2404361900-60179841
Opcode ID: 08df77c958f7f95b143f96817199e936ae02818c0219ec50d3c265a4907632d8
Instruction ID: 1aa1fcdee2580bb43a7c569bcfbd4f4ec5c4a6792e593a09f2379888005b03b8
Opcode Fuzzy Hash: 08df77c958f7f95b143f96817199e936ae02818c0219ec50d3c265a4907632d8
Instruction Fuzzy Hash: 2E7293F1D042288ADB35CA25CC90FD9BBB5AF65308F0481EDE64DA7241EB385E85CF95

Function 604A3C00 Relevance: 43.7, APIs: 20, Strings: 4, Instructions: 1659COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?), ref: 604A3DFE
ReleaseSRWLockExclusive.KERNEL32(?), ref: 604A3EA0
ReleaseSRWLockExclusive.KERNEL32(?,?,00000001,00000000,00004000,00000000), ref: 604A3F38

Strings

first, xrefs: 604A408C, 604A40EF, 604A4669, 604A4697, 604A46DD, 604A4FB2, 604A5186, 604A51DC, 604A520C, 604A525F
@)W`, xrefs: 604A4622
@)W`, xrefs: 604A461D
@)W`, xrefs: 604A3C1A, 604A4136, 604A45E7, 604A462C, 604A473B, 604A5145, 604A528B

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID: @)W`$@)W`$@)W`$first
API String ID: 1021914862-1760890915
Opcode ID: c7571c627faf58cc6238ad8c5102f76b07ef59a7211ad1e30493019641bcb617
Instruction ID: 8cf069472f875148d67e4e3611d47b3ba841301cbec9ecd4ea8891bb02fc3d60
Opcode Fuzzy Hash: c7571c627faf58cc6238ad8c5102f76b07ef59a7211ad1e30493019641bcb617
Instruction Fuzzy Hash: 5AD20371A043018FD728CF28C880B6ABBE2BFE5358F15856CE9559B399DB38DD45CB81

Function 60475140 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 260
nativeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitUnicodeString.NTDLL(?,FFFFFFFF), ref: 6047516F
NtQueryValueKey.NTDLL ref: 604752ED
NtQueryValueKey.NTDLL ref: 60475364
NtQueryValueKey.NTDLL ref: 604753D5
NtQueryValueKey.NTDLL ref: 60475407
NtQueryValueKey.NTDLL ref: 6047543D

Strings

__location != nullptr, xrefs: 60475473
..\..\third_party\libc++\src\include\__memory\construct_at.h, xrefs: 60475395
\BLBeacon, xrefs: 60475144
null pointer given to destroy_at, xrefs: 60475389
__loc != nullptr, xrefs: 6047538E
%s:%d: assertion %s failed: %s, xrefs: 6047539A
null pointer given to construct_at, xrefs: 6047546E

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: QueryValue$InitStringUnicode
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\__memory\construct_at.h$\BLBeacon$__loc != nullptr$__location != nullptr$null pointer given to construct_at$null pointer given to destroy_at
API String ID: 859960800-1453909569
Opcode ID: e3c5b08250aa5921f86f6a63446cb11eeaf993404e85d5d815ec7f4b2372b2d0
Instruction ID: add650a078e450785130f33fb2af6cae0af33d9727202be923b5b631ce75ea5d
Opcode Fuzzy Hash: e3c5b08250aa5921f86f6a63446cb11eeaf993404e85d5d815ec7f4b2372b2d0
Instruction Fuzzy Hash: FC9184609042409EDB308B788884FEF7FE49F66724F158659E8359F3E5C3F99885C752

Function 604A0D00 Relevance: 18.4, APIs: 7, Strings: 3, Instructions: 919COMMON

Download Yara Rule

APIs

ReleaseSRWLockExclusive.KERNEL32(-000000C0), ref: 604A15CB

Strings

first, xrefs: 604A1908
span, xrefs: 604A12EF
size, xrefs: 604A12FC

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLockRelease
String ID: first$size$span
API String ID: 1766480654-3452983260
Opcode ID: 62705c0f27c0952881aee2f16f7c4d78e7204c7f196ca12b4ed8a54931d5b28d
Instruction ID: ee047f4419870b5c0ae9cca15034ee9c03b94ab8f5c212a351fb1a97e15f4c38
Opcode Fuzzy Hash: 62705c0f27c0952881aee2f16f7c4d78e7204c7f196ca12b4ed8a54931d5b28d
Instruction Fuzzy Hash: 3382D175A043019FD724CF28C480B9AB7E2FFA8314F19856DE9999B359D738ED42CB81

Function 00B64E20 Relevance: 13.2, Strings: 10, Instructions: 739
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(bq, xrefs: 00B655A3
(bq, xrefs: 00B64EAC
(bq, xrefs: 00B651F9
(bq, xrefs: 00B651CD
(bq, xrefs: 00B6589B
(bq, xrefs: 00B65655
(bq, xrefs: 00B65056
(bq, xrefs: 00B655CF
(bq, xrefs: 00B6586F
(bq, xrefs: 00B65082

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq$(bq
API String ID: 0-668029649
Opcode ID: 4b649872165b24deffa31e3a7bc4f5d37016844b9a24e6acfc20ace586e25dff
Instruction ID: 9c707735cdba4be9348e8b3445d0977d511e8db5d64d8d075b64b144e4b2f6cb
Opcode Fuzzy Hash: 4b649872165b24deffa31e3a7bc4f5d37016844b9a24e6acfc20ace586e25dff
Instruction Fuzzy Hash: 9A52E231B046548FCB15DF68D8546AEBBF2EF89310F2580A9D506EB3A1DF389D06CB91

Function 604A36F0 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 363
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 604A2C10: TryAcquireSRWLockExclusive.KERNEL32(?), ref: 604A2C53
Part of subcall function 604A2C10: ReleaseSRWLockExclusive.KERNEL32(?,?,00000021,?,00004000,000000FF), ref: 604A2D4A

TryAcquireSRWLockExclusive.KERNEL32(?), ref: 604A38D2
ReleaseSRWLockExclusive.KERNEL32(?), ref: 604A3971
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 604A39A5
ReleaseSRWLockExclusive.KERNEL32(?,?,00000000,00000000,00004000,00000000), ref: 604A3A51
ReleaseSRWLockExclusive.KERNEL32(?,?,00000000,00000000,00004000,00000000), ref: 604A3BE6

Strings

first, xrefs: 604A3B86, 604A3BC9
@)W`, xrefs: 604A370A

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID: @)W`$first
API String ID: 1021914862-1331278718
Opcode ID: e5f14dc56c941800c4162857cb9b631effe4e28c908da06553a9013abef659ad
Instruction ID: 64b1f29d29ecf82d9c86020e0f59596f11db1fd9cc1de9b8b3236309d8ef208a
Opcode Fuzzy Hash: e5f14dc56c941800c4162857cb9b631effe4e28c908da06553a9013abef659ad
Instruction Fuzzy Hash: DBE1F3716043018FD718CF28C884B66BBE2FFA5318F19856CF9458B39AE779E945CB81

Function 60474FA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 126
nativeCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitUnicodeString.NTDLL(CVG`,?), ref: 604750AB
NtOpenKeyEx.NTDLL(?,?,?,00000000), ref: 604750D6

Part of subcall function 60474970: RtlFormatCurrentUserKeyPath.NTDLL(?), ref: 60474995
Part of subcall function 60474970: RtlFreeUnicodeString.NTDLL(?), ref: 604749DD
Part of subcall function 60474970: GetCommandLineW.KERNEL32(?,?,?), ref: 604749F8
Part of subcall function 60474970: GetEnvironmentVariableW.KERNEL32(PROGRAMFILES,?,00000104,?,?,?), ref: 60474A0B
Part of subcall function 60474970: GetEnvironmentVariableW.KERNEL32(PROGRAMFILES(X86),?,00000104,?,?,?), ref: 60474A3A
Part of subcall function 60474970: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 60474A70
Part of subcall function 60474970: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 60474A7C
Part of subcall function 60474970: GetCurrentProcess.KERNEL32(?,?,?), ref: 60474A88

Strings

CVG`, xrefs: 6047509A
CVG`, xrefs: 604750A6, 604750AA

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CurrentEnvironmentStringUnicodeVariable$AddressCommandFormatFreeHandleInitLineModuleOpenPathProcProcessUser
String ID: CVG`$CVG`
API String ID: 3669629139-1012662543
Opcode ID: 08f6ad4a27d4e12b3e9602cc7230fe901fde7604a1d6fc6ad0d0284a904bec88
Instruction ID: 9b3efae898c6018cdae522271f9013f94e31c1249f38a2b54384d5769657b352
Opcode Fuzzy Hash: 08f6ad4a27d4e12b3e9602cc7230fe901fde7604a1d6fc6ad0d0284a904bec88
Instruction Fuzzy Hash: 7241A0B1D04259AFDB31CF64D841FEE7BB5AFA5308F148029F805AB250EB789945CBD1

Function 60475610 Relevance: 1.5, APIs: 1, Instructions: 46nativeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 60474FA0: RtlInitUnicodeString.NTDLL(CVG`,?), ref: 604750AB
Part of subcall function 60474FA0: NtOpenKeyEx.NTDLL(?,?,?,00000000), ref: 604750D6

NtClose.NTDLL ref: 60475684

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CloseInitOpenStringUnicode
String ID:
API String ID: 2903745284-0
Opcode ID: 6b6b6d3d79339e933f64d7fd0058abc164619d8b691a6162dbad03a0af383b94
Instruction ID: 4149fbd7e92178c0287f0d2a2257005c6bdf2c8fc0540f175ff0059918a03009
Opcode Fuzzy Hash: 6b6b6d3d79339e933f64d7fd0058abc164619d8b691a6162dbad03a0af383b94
Instruction Fuzzy Hash: 130184B1D001186FDF209FA4AC41EEEBB69EF65228F418118FC183B281D7B96D15C7E1

Function 60466800 Relevance: 122.0, APIs: 97, Instructions: 740sleepmemoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01,00000000,?,00000000,?,?,60466E01,00000000,?,?), ref: 6046682C
GetLastError.KERNEL32(?,60466E01,00000000,?,?), ref: 60466856
GetLastError.KERNEL32 ref: 60466897
Sleep.KERNEL32(00000032), ref: 604668B1
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 604668BF
GetLastError.KERNEL32 ref: 604668C9
Sleep.KERNEL32(00000032), ref: 604668E7
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 604668F5
GetLastError.KERNEL32 ref: 60466903
Sleep.KERNEL32(00000032), ref: 60466921
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 6046692F
GetLastError.KERNEL32 ref: 6046693D
Sleep.KERNEL32(00000032), ref: 6046695B
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 60466969
GetLastError.KERNEL32 ref: 60466977
Sleep.KERNEL32(00000032), ref: 60466995
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 604669A3
GetLastError.KERNEL32 ref: 604669B1
Sleep.KERNEL32(00000032), ref: 604669CF
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 604669DD
GetLastError.KERNEL32 ref: 604669EB
Sleep.KERNEL32(00000032), ref: 60466A09
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 60466A17
GetLastError.KERNEL32 ref: 60466A25
Sleep.KERNEL32(00000032), ref: 60466A43
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 60466A51
GetLastError.KERNEL32 ref: 60466A5F
Sleep.KERNEL32(00000032), ref: 60466A7D
VirtualAlloc.KERNEL32(?,00000000,00003000,60466E01), ref: 60466A8B
GetLastError.KERNEL32 ref: 60466A99
Sleep.KERNEL32(00000032), ref: 60466AB7

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ErrorLast$AllocSleepVirtual
String ID:
API String ID: 4039713267-0
Opcode ID: d35988517d78a7db6fdcde9ccbf9068cb1002c5896cdbf35d67baa424aad9026
Instruction ID: 28deaeba9750c40b2aef9d57a23fffab0f547df8f8f3953a710616ed1b6aa148
Opcode Fuzzy Hash: d35988517d78a7db6fdcde9ccbf9068cb1002c5896cdbf35d67baa424aad9026
Instruction Fuzzy Hash: BC42A131A14106AFDF226FA4CC4DF9E7F76EF27355F114028E505AA260EB348A84CF52

Function 604A07F0 Relevance: 37.7, APIs: 30, Instructions: 182
memorysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,00000001,00001000,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A081A
GetLastError.KERNEL32(?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A084D
Sleep.KERNEL32(00000032,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A0867
VirtualAlloc.KERNEL32(?,00000001,00001000,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A0877
Sleep.KERNEL32(00000032,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A08A0
VirtualAlloc.KERNEL32(?,00000001,00001000,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A08B0
GetLastError.KERNEL32(?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A08C0
GetLastError.KERNEL32(?,?,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A08E1
Sleep.KERNEL32(00000032,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A08FF
VirtualAlloc.KERNEL32(?,00000001,00001000,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A090F
GetLastError.KERNEL32(?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A091D
Sleep.KERNEL32(00000032,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A093B
VirtualAlloc.KERNEL32(?,00000001,00001000,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A094B
GetLastError.KERNEL32(?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A0959
Sleep.KERNEL32(00000032,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A0977
VirtualAlloc.KERNEL32(?,00000001,00001000,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A0987
GetLastError.KERNEL32(?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A0995
Sleep.KERNEL32(00000032,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A09B3
VirtualAlloc.KERNEL32(?,00000001,00001000,?,?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A09C3
GetLastError.KERNEL32(?,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A09D1

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: AllocErrorLastVirtual$Sleep
String ID:
API String ID: 1485398201-0
Opcode ID: 27d4cc50ace4eab1d8744c5cad21e77f2fb4797dcee7308b41c30f1d564d0157
Instruction ID: fa9cc3e9224be9f6af5688e9593cab61c467115a850c3f472961a89971698889
Opcode Fuzzy Hash: 27d4cc50ace4eab1d8744c5cad21e77f2fb4797dcee7308b41c30f1d564d0157
Instruction Fuzzy Hash: 3B515B30645201AFDF322B65CC4DF9E3E39EF77795F214028F14AA91A5D7688A80CA96

Function 60466590 Relevance: 37.7, APIs: 30, Instructions: 176
sleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000005,?,?,?,?,00000000,00000000,?,60466B27,?,?,00001000), ref: 604665AA
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 604665D0
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 604665EA
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 604665F8
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 60466606
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 60466614
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 60466620
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 6046663A
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 60466658
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 60466666
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 60466674
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 60466692
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 604666A0
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 604666AE
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 604666CC
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 604666DA
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 604666E8
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 60466706
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 60466714
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 60466722
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 60466740
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 6046674E
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 6046675C
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 6046677A
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 60466788
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 60466796
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 604667B4
VirtualAlloc.KERNEL32(00000005,?,?,?,?,60466B27,?,?,00001000), ref: 604667C2
GetLastError.KERNEL32(?,60466B27,?,?,00001000), ref: 604667D0
Sleep.KERNEL32(00000032,?,60466B27,?,?,00001000), ref: 604667EE

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: AllocErrorLastSleepVirtual
String ID:
API String ID: 2288223010-0
Opcode ID: 7a9f5c0408b194e564381d5d625932736202e893e7f9a24078e5a9189ead5c6c
Instruction ID: 0cec0c2410c37b544bb453467239227ae5b8ee6a87d77ef48572a2a461e71eb1
Opcode Fuzzy Hash: 7a9f5c0408b194e564381d5d625932736202e893e7f9a24078e5a9189ead5c6c
Instruction Fuzzy Hash: 25513A70115106BBCF222F61DC4EE9E3FBAEF63759F114028F506A9571E7358A88DE12

Function 60474970 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 114
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFormatCurrentUserKeyPath.NTDLL(?), ref: 60474995
RtlFreeUnicodeString.NTDLL(?), ref: 604749DD
GetCommandLineW.KERNEL32(?,?,?), ref: 604749F8
GetEnvironmentVariableW.KERNEL32(PROGRAMFILES,?,00000104,?,?,?), ref: 60474A0B
GetEnvironmentVariableW.KERNEL32(PROGRAMFILES(X86),?,00000104,?,?,?), ref: 60474A3A
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?), ref: 60474A70
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 60474A7C
GetCurrentProcess.KERNEL32(?,?,?), ref: 60474A88

Strings

IsWow64Process, xrefs: 60474A76
kernel32.dll, xrefs: 60474A6B
\BLBeacon, xrefs: 60474974
PROGRAMFILES(X86), xrefs: 60474A35
PROGRAMFILES, xrefs: 60474A06

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CurrentEnvironmentVariable$AddressCommandFormatFreeHandleLineModulePathProcProcessStringUnicodeUser
String ID: IsWow64Process$PROGRAMFILES$PROGRAMFILES(X86)$\BLBeacon$kernel32.dll
API String ID: 1360800022-3675488706
Opcode ID: ae9fa2105a050d81df7373345444e2b5e5fb6fd79e5ade9bf65505bdfc279eea
Instruction ID: 10a1a143034728162397efbd2a352ba7db991e3f1f60c70349ff6b3607994283
Opcode Fuzzy Hash: ae9fa2105a050d81df7373345444e2b5e5fb6fd79e5ade9bf65505bdfc279eea
Instruction Fuzzy Hash: 3431E9716442146BEB309B755C8DFFF7FACDF72399F000068F805A2241EB789945DAA1

Function 60469A70 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 124
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000025,__location != nullptr,null pointer given to construct_at), ref: 60469B56
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000025,__location != nullptr,null pointer given to construct_at), ref: 60469B66

Strings

__n == 0 || __s != nullptr, xrefs: 60469AFA
basic_string(const char*, n) detected nullptr, xrefs: 60469AF5
..\..\third_party\libc++\src\include\__string\char_traits.h, xrefs: 60469B1A
..\..\third_party\libc++\src\include\string, xrefs: 60469B04
%s:%d: assertion %s failed: %s, xrefs: 60469B1F
char_traits::copy overlapped range, xrefs: 60469B0B
__s2 < __s1 || __s2 >= __s1+__n, xrefs: 60469B10

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: PerformanceQuery$CounterFrequency
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\__string\char_traits.h$..\..\third_party\libc++\src\include\string$__n == 0 || __s != nullptr$__s2 < __s1 || __s2 >= __s1+__n$basic_string(const char*, n) detected nullptr$char_traits::copy overlapped range
API String ID: 774501991-1402792131
Opcode ID: 1800a2ae72fe2adb7d06c21e2cc8df3c07e8acce5639aede280c531520e489b9
Instruction ID: 8298b79c58b31f99c3faeff1f16f3a8b73e256d8797e79134b187e35d6d3e3d4
Opcode Fuzzy Hash: 1800a2ae72fe2adb7d06c21e2cc8df3c07e8acce5639aede280c531520e489b9
Instruction Fuzzy Hash: 50413470504714AFC721DF65C880C5ABBE8FFA6354F108A2EF889A7210EB759955C792

Function 604E092A Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 604E0D2F: CreateFileW.KERNELBASE(565753E5,89167401,1839FFFD,8B08758B,D043E8CF,8BE85653,00000000,604FE636,604E09D3,68F1890C,604FE61E), ref: 604E0D4C

GetLastError.KERNEL32 ref: 604E0A3E
__dosmaperr.LIBCMT ref: 604E0A45
GetFileType.KERNEL32(00000000), ref: 604E0A51
GetLastError.KERNEL32 ref: 604E0A5B
__dosmaperr.LIBCMT ref: 604E0A64
CloseHandle.KERNEL32 ref: 604E0A84
CloseHandle.KERNEL32(89167401), ref: 604E0BD1
GetLastError.KERNEL32 ref: 604E0C03
__dosmaperr.LIBCMT ref: 604E0C0A

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 138532a26fc8398d47a661d6bd59b3b4535f32581592091aec2b4d2c933e6de0
Instruction ID: d0c362d2864c596af16264f51721baeb3ef6219c59d67f425b29a395c1599642
Opcode Fuzzy Hash: 138532a26fc8398d47a661d6bd59b3b4535f32581592091aec2b4d2c933e6de0
Instruction Fuzzy Hash: E6A14732A142149FDF299FA8DC51FAD3FB1AB27319F14015DE821AB3D1DB399852CB81

Function 604CE63E Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 604CE67B
dllmain_crt_dispatch.LIBCMT ref: 604CE692
dllmain_raw.LIBCMT ref: 604CE6DA
dllmain_crt_dispatch.LIBCMT ref: 604CE6ED
dllmain_raw.LIBCMT ref: 604CE700

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: db57c649beb2e7ff1a74fb233789eed31399c9808b4b3cbef6ac84fa37665649
Instruction ID: 23341dbd1f44413165ce07faf0babe59a766c2d7a99e51254b93ce53549a6bcf
Opcode Fuzzy Hash: db57c649beb2e7ff1a74fb233789eed31399c9808b4b3cbef6ac84fa37665649
Instruction Fuzzy Hash: 99218079E11628AACB324E56C8C3F6F3A79EBB0698F014529F8155B210F3388D418BD2

Function 604A2010 Relevance: 4.6, APIs: 3, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,60467598), ref: 604A2021
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,00000000,?,60467598), ref: 604A2167
ReleaseSRWLockExclusive.KERNEL32 ref: 604A21BA

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 749297eaf987bc4d3a408821c5c4290caa01257e1e4a34e6c7d873814046d3a8
Instruction ID: c17dfbaea69fe06b8484eb87e4195ce94ca7f7dc61c7d4602bbdb5b8e4e6063c
Opcode Fuzzy Hash: 749297eaf987bc4d3a408821c5c4290caa01257e1e4a34e6c7d873814046d3a8
Instruction Fuzzy Hash: 8641F2709087858BD725AF39CA4069DFFA0BF36308F054A2DD99496311EB39A9D4D7C2

Function 60466AD0 Relevance: 3.8, APIs: 3, Instructions: 95COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,6046656E,FFE00000,00000002,?,604A1D5F,00000002,FFE00000,?,00000002,FFE00000,?,?), ref: 60466ADD

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 77471a66a8629f6b780d8b8b98be1d441028099016ac40ffb68daece5030cb59
Instruction ID: b16ebf9322f57c9fc8d6cba1f2ea500312b71054242d9baa2a6613c8221d9606
Opcode Fuzzy Hash: 77471a66a8629f6b780d8b8b98be1d441028099016ac40ffb68daece5030cb59
Instruction Fuzzy Hash: 2A11E170B58218EBEB240E18CC14F553F5AEB32744F104825FB08DB380FA7DAC529A96

Function 00B63750 Relevance: 3.8, Strings: 3, Instructions: 88COMMON

Download Yara Rule

Strings

(bq, xrefs: 00B63820
(bq, xrefs: 00B637B2
(bq, xrefs: 00B63786

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq$(bq
API String ID: 0-2716923250
Opcode ID: 3c228e4279758a36dae11565c24f77947218f90c60b3bfc1d46bf1af7ea6a3ca
Instruction ID: c74039b0d2841c6762fbed3f86ecff13d1ce087ec2d1cbd05ee228c09764155c
Opcode Fuzzy Hash: 3c228e4279758a36dae11565c24f77947218f90c60b3bfc1d46bf1af7ea6a3ca
Instruction Fuzzy Hash: 18210832B081944FD75A6B79581453E2BF7DBD632131842AAE90AC77D1DE388D0B83A6

Function 60475D10 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(type,?,?,?,?,?,00000000,00000001,?,?,60461637), ref: 60475D40

Strings

type, xrefs: 60475D36

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CommandLine
String ID: type
API String ID: 3253501508-2363381545
Opcode ID: 01985f97e7bc73ff7813cfdb4dccc840db957d5075218629a16a81126fdefc71
Instruction ID: 71e06255bc10217561d1c6862419f2a8c2f9f2d40e53851df17331d4dce6a42a
Opcode Fuzzy Hash: 01985f97e7bc73ff7813cfdb4dccc840db957d5075218629a16a81126fdefc71
Instruction Fuzzy Hash: 6211B2B1D002185BCF319B61DC49EDEBFB5EF66218F04C429E809A6200E7795659C7D2

Function 604A5DA0 Relevance: 3.3, APIs: 2, Instructions: 273COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?), ref: 604A5F97
ReleaseSRWLockExclusive.KERNEL32(?,00000001), ref: 604A6001

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: cd36247b209d43198d354a0ee9b94c0034f41d3095d83dd3d828e29bfe6c4689
Instruction ID: accbc0bf53be6954a3e8d789dc258184a4057cd708486e4a2f59092882499ae7
Opcode Fuzzy Hash: cd36247b209d43198d354a0ee9b94c0034f41d3095d83dd3d828e29bfe6c4689
Instruction Fuzzy Hash: 76A104726002028FD725CF68C544F65BBF1BF65318F198268E9198B79AD739ED91CBC0

Function 604A1A20 Relevance: 3.2, APIs: 2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a399552c4597c363390827536bded583eb986abbd679052aeb5e48161d8ee64
Instruction ID: fd97bc2e8516b32d652c5603858c36844f678a8c9edb5a81fc6e4a59229e1d4e
Opcode Fuzzy Hash: 2a399552c4597c363390827536bded583eb986abbd679052aeb5e48161d8ee64
Instruction Fuzzy Hash: 6AA1D075A00A119FD718CF29C890BE9B7F5FFA8314F04812DE829977A9D738A941CBD0

Function 604CE3FB Relevance: 3.1, APIs: 2, Instructions: 92COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 604CE448

Part of subcall function 604CE80B: InitializeSListHead.KERNEL32(60566558,604CE452,605490A8,00000010,604CE5FB,?,00000000,?,00000007,605490C8,00000010,604CE60E,?,?,604CE697,?), ref: 604CE810

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 604CE4B2

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 238e2398203b5d26dcaf8b6a3c8ac6d9fe7cafb71d749fdec421a76da21db62d
Instruction ID: 7331b2e027bde358df1ec626064845b5055015c962b9680d38f4ac2e9b2a8d16
Opcode Fuzzy Hash: 238e2398203b5d26dcaf8b6a3c8ac6d9fe7cafb71d749fdec421a76da21db62d
Instruction Fuzzy Hash: 0B21D539284240AADB349FB9D847F983FA0DB3632CF10442DE94167291FB7D5445D6AB

Function 604CE502 Relevance: 3.1, APIs: 2, Instructions: 90COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 604CE549
___scrt_uninitialize_crt.LIBCMT ref: 604CE563

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: ed440b7a997af92a05fe21f5da254adb2287e33e73938afafb106513959c801d
Instruction ID: 329e3378f3fd008ca495bea0c5c5d96edfb1de9059c57acb354d3f8e123050db
Opcode Fuzzy Hash: ed440b7a997af92a05fe21f5da254adb2287e33e73938afafb106513959c801d
Instruction Fuzzy Hash: C821D77A958254EAD7309FEE8947FAC7BA0EB3131DF10411EF41096190FB7D89019697

Function 00B63BE0 Relevance: 3.0, Strings: 2, Instructions: 461COMMON

Download Yara Rule

Strings

(bq, xrefs: 00B63DE5
(bq, xrefs: 00B6419C

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: b53f6c85823c7d0a565eb9a3b4e24b49581cd780daab5529b44c18a253529b5d
Instruction ID: 7ab768104035d35a0197b104032437ec4c3689053eefdcc4df09f7ecb979ab4b
Opcode Fuzzy Hash: b53f6c85823c7d0a565eb9a3b4e24b49581cd780daab5529b44c18a253529b5d
Instruction Fuzzy Hash: 12F15D31B002049FDB09AB68D954B6E7BF7EFC9300F148469E506EB3A9DE39DC468B51

Function 604E9C8B Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(8955CCCC,604FE74C,604DE571,604E8B90,8955CCCC,00000000,604FE6C6,604CEEAE,00000000,604FE74C,8955CCCC,604FE746,?,?,604FE6DA,60510573), ref: 604E9C8F
SetLastError.KERNEL32(00000000), ref: 604E9D31

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 42b132c78297e5c8140f2a2040f0d285f33a3790baf6b5042086fe08b147120b
Instruction ID: f213558f16cc5260b304037024350d74ce7392404d7fb6294460bfbc0c506b01
Opcode Fuzzy Hash: 42b132c78297e5c8140f2a2040f0d285f33a3790baf6b5042086fe08b147120b
Instruction Fuzzy Hash: FF11C6712182156EEA317BB7CCCAE9A7E69DF7336F7210138F514912E0DB5E4C129190

Function 604A07C0 Relevance: 2.5, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000001,00004000,?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A07CE
GetLastError.KERNEL32(?,604A1E3F,00000001,?,00000001,?,?,?,604FCFA4), ref: 604A07DA

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ErrorFreeLastVirtual
String ID:
API String ID: 499627090-0
Opcode ID: 66e1524f213d53547bf82fea6c430b4bb33eb6dbcafc00e655dddef5a38376c5
Instruction ID: 2fc7f92f52d749e6873022fbabe4f2d249790bd47a1eabcec03bf2e642a0c4af
Opcode Fuzzy Hash: 66e1524f213d53547bf82fea6c430b4bb33eb6dbcafc00e655dddef5a38376c5
Instruction Fuzzy Hash: E9D0C934240209BBAF102F61EC48B553F59AB22B51F008411FA19A9961EA36E9509E54

Function 60474D30 Relevance: 1.6, APIs: 1, Instructions: 149COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6047433A,?), ref: 60474D9F

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: db009bd98a5893458f9af9014d4acb859d24588f876cc4a0a7bd1e16e10568ce
Instruction ID: 89a342d240dafb7517bec17c77881d539ed3b1c244e713ed1396850e60a986e7
Opcode Fuzzy Hash: db009bd98a5893458f9af9014d4acb859d24588f876cc4a0a7bd1e16e10568ce
Instruction Fuzzy Hash: 4A517D70E042189FCB35CFA8C484AEDBBF2BFA9364F15C129E455AB351D7789981CB81

Function 60477270 Relevance: 1.6, APIs: 1, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00000000,00000104), ref: 604772B8

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 86e37a8bf68537f3201c85c89a8aacc50620bd7a89ee728aae3b40f7e5c49e15
Instruction ID: b7fa2343ef386f9815024d35cf1c70d62c7ac4cd8fa6473281aafbc8d8c4f76b
Opcode Fuzzy Hash: 86e37a8bf68537f3201c85c89a8aacc50620bd7a89ee728aae3b40f7e5c49e15
Instruction Fuzzy Hash: 6B2141B1D002095BDB309FA69C45DEFBFB8EF66308F40842DE85576200D7755945CBA1

Function 00B6385C Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

(bq, xrefs: 00B63BA1

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: f7b01b5827b4e0f7074fcfb9a724334aea57a9cab819b24c31bdf1f5c7cbe7e3
Instruction ID: 7b042628d4a8c6cf3eb56a406c0fb20b9f4cc78bc5d5facd244b51c109352e79
Opcode Fuzzy Hash: f7b01b5827b4e0f7074fcfb9a724334aea57a9cab819b24c31bdf1f5c7cbe7e3
Instruction Fuzzy Hash: 89C16034B00218DFDB05DBA8D954AAE7BF7EF89700F148069E905A73A4DB39DD41CB91

Function 604E7CC4 Relevance: 1.5, APIs: 1, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,604D226B), ref: 604E08E2

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 2f85578fcd3bf92a21dc8cc330ca50db2ce42154a7c992b926f630c119d77fd3
Instruction ID: e3cd310b672f94ccacb6aa55d63aaa51d462b6f1d6c0a53941a1badb801d16b7
Opcode Fuzzy Hash: 2f85578fcd3bf92a21dc8cc330ca50db2ce42154a7c992b926f630c119d77fd3
Instruction Fuzzy Hash: 54F0BB3514030E76FF212E625C07F9A3E196F7175EF504028BF28681D2EFAAC8A192D1

Function 604E0D2F Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(565753E5,89167401,1839FFFD,8B08758B,D043E8CF,8BE85653,00000000,604FE636,604E09D3,68F1890C,604FE61E), ref: 604E0D4C

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b0e8d94829b999177352271e88343e6dccc9e1f9ab8a0ab12b3671f2b92aef4b
Instruction ID: 87ad05c4e5932bb1dd5d36cc2dc58799e8f6bfadf531effa7de479d6e4dc6040
Opcode Fuzzy Hash: b0e8d94829b999177352271e88343e6dccc9e1f9ab8a0ab12b3671f2b92aef4b
Instruction Fuzzy Hash: 57D06C3200010DBBDF029F84DD06EDA3FAAFB48714F014000BA1866020C736E821AB90

Function 00B6BEAF Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00B6BF75

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: e0a44e343054fe6a7e3dd9dd183ac573c0b9e3c0b1e5eaf3ec105bdca5b6c41d
Instruction ID: ee74242af562a9c303c493792d46d4298d2b0b7510603ac44dd4c444e57604fa
Opcode Fuzzy Hash: e0a44e343054fe6a7e3dd9dd183ac573c0b9e3c0b1e5eaf3ec105bdca5b6c41d
Instruction Fuzzy Hash: 50418D347005048FCB44DF2DC998A6EBBF6FF89710B2585A9E506DB3B6DA71DC058B90

Function 00B6BEC0 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

Te^q, xrefs: 00B6BF75

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: Te^q
API String ID: 0-671973202
Opcode ID: 52017de9d414e3a4b51fac271efc84ec14af432e644764325b0d8a0e2cfe1f15
Instruction ID: b1d27c2755982ef9a11ae71e00212a87b43a04b48de709043d76138dc4f8a2fb
Opcode Fuzzy Hash: 52017de9d414e3a4b51fac271efc84ec14af432e644764325b0d8a0e2cfe1f15
Instruction Fuzzy Hash: 1F417E347005048FCB44DF6DC598A6EBBF6FF89710B2584A9E506DB3B6DA71EC058B80

Function 00B62B10 Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

LR^q, xrefs: 00B62B35

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: LR^q
API String ID: 0-2625958711
Opcode ID: cf01b72b4454834e799bde90d9232138a7ff8272e4c5d729caccedaaae867c4e
Instruction ID: 024d11a65a04ee5cfdd0c3607df3c822f757bd613a0544d6143d5796ba17f8d8
Opcode Fuzzy Hash: cf01b72b4454834e799bde90d9232138a7ff8272e4c5d729caccedaaae867c4e
Instruction Fuzzy Hash: 8E3130317406058FD709AB35C454A2E33B3EFCAA047258068D24ACF3A8EE35DC43CB8A

Function 00B64237 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

(bq, xrefs: 00B64295

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 15bbf9292ea14c405976df6fb2451fab07a2bf1675db07d6d361ce884c090078
Instruction ID: 548320d73825796e0c5dcbd915c1cbf36fe092c4799d0e3dc4c3668df6dce108
Opcode Fuzzy Hash: 15bbf9292ea14c405976df6fb2451fab07a2bf1675db07d6d361ce884c090078
Instruction Fuzzy Hash: 001125226081804FD30A573958242792FA2DFC3611B5940EED485CBB92CE389D4E8396

Function 00B61049 Relevance: .8, Instructions: 841COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c719b6cf6a30315c254d956291716e96e7ff350d1355a418ac8f23f13c4ad196
Instruction ID: f0dda143e3354b51a6b026b2d656daee3cdd0f9686ca07fbc1dafd7cb031b914
Opcode Fuzzy Hash: c719b6cf6a30315c254d956291716e96e7ff350d1355a418ac8f23f13c4ad196
Instruction Fuzzy Hash: 2F82D178641209DFDB06EBA4D654F6E7B76EB88300F108814E801337ADDB3AAD95DB35

Function 00B61058 Relevance: .8, Instructions: 835COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c0a1a8a6911258710235791d9af19bc1cd01f7759bd2325cd3ef0017a9ef3c2
Instruction ID: 9b4feff71acb1acff2bb1b83025cf9c98d239a82793a3fc9f31890a34c14a443
Opcode Fuzzy Hash: 4c0a1a8a6911258710235791d9af19bc1cd01f7759bd2325cd3ef0017a9ef3c2
Instruction Fuzzy Hash: 3B82C078641209DFDB06EBA4D654F6E7B76EB88300F108814E801337ADDB3AAD95DB35

Function 00B6B0B0 Relevance: .7, Instructions: 680COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a1ac9ab7d0a9fb9566ce0d3b7b630ed6832dbcf8f59448e4c32ec7d451dbab
Instruction ID: 84b2a5fcabf677c45ab45b4bc93d5c1891dc2766c5a93687593e9ed62e5d0d11
Opcode Fuzzy Hash: 01a1ac9ab7d0a9fb9566ce0d3b7b630ed6832dbcf8f59448e4c32ec7d451dbab
Instruction Fuzzy Hash: 6F522634A01200CFD719EF74D958A6977B2FF84305B24C4A9D41A9B36AEB79EC86CF41

Function 00B6AF90 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4745babb01ebabe712265db33c3478f824dc80bdedfa6cff890f2efe6a1663
Instruction ID: a2026c6fdc50a6624b954843abc5b087c2b75bac1b1451a984a5fb22962873c6
Opcode Fuzzy Hash: 4a4745babb01ebabe712265db33c3478f824dc80bdedfa6cff890f2efe6a1663
Instruction Fuzzy Hash: E661087290A3805FD703973899615D9BFB1EF83314B0981EBC185CB1B7EA689D4EC7A1

Function 00B6C060 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884b0494ae5ad28ee68f62c1790b77fd2af39f25338561171e7186fa01da5091
Instruction ID: d37659e00aaff6bb4e387083e378619b79cb12f7bcac3a7dc30402b6c6a7c300
Opcode Fuzzy Hash: 884b0494ae5ad28ee68f62c1790b77fd2af39f25338561171e7186fa01da5091
Instruction Fuzzy Hash: 6571E7726006049FD355DB24CA5059BFBF2EF843047158E6E804A9FB65EF72F94A8BC1

Function 00B6C070 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6197050c6821cefca93556c53438fc0870fce6f9fcfcbb8a3410e9cd85b400a3
Instruction ID: 6c536340c7345214ad7f1eea39d498199d627e15607816b8b5c294bbea4533df
Opcode Fuzzy Hash: 6197050c6821cefca93556c53438fc0870fce6f9fcfcbb8a3410e9cd85b400a3
Instruction Fuzzy Hash: 9B71E7726006049FD355EB24CA5059BFBF2EF843043558E6E804A9FB65EF72F94A8BC1

Function 00B6BB99 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e648f71376c2ccf5f2d45c610495092aa310228578ecd4652134d4c2d73f59c
Instruction ID: 0c158f49241569ee993de649674c1f71b3f5e4a00baf3c038f33db11f498488e
Opcode Fuzzy Hash: 7e648f71376c2ccf5f2d45c610495092aa310228578ecd4652134d4c2d73f59c
Instruction Fuzzy Hash: EA81E638942105CFD712EB64EA99E59BBB2FF44304B15C5A8D1298B329E779ECC9CF40

Function 00B65A91 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09c57e7ef729585aec6e2ba78e3939b6ee683358bb3e4ed1cf7e9ee81f2664e
Instruction ID: 05d7c9c003bfc878892a9b821da53edaa4feb39521bdc241150d694318aae20d
Opcode Fuzzy Hash: e09c57e7ef729585aec6e2ba78e3939b6ee683358bb3e4ed1cf7e9ee81f2664e
Instruction Fuzzy Hash: 37514B75B006058FCB14DF69D994E6EBBF6EF88310B1181A8E50ADB365DB74EC05CBA0

Function 00B6C798 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec9227d46f5a1722a34f377f28006b4b1a7c3eae82456b037e5e9f430da40dc
Instruction ID: e4b90791dec4a629ac745bd78252612ac5086590897c25854f032d94574ba655
Opcode Fuzzy Hash: 1ec9227d46f5a1722a34f377f28006b4b1a7c3eae82456b037e5e9f430da40dc
Instruction Fuzzy Hash: 565103726006009FC315EB24C94149AFBF2EF853043118A6ED08A9B765EF72FA4B8BC1

Function 00B65240 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5139c58115fa4b1e7815cd28c69c089ab5c33399aa7050c56c6b4adc2406d397
Instruction ID: f24efb45ab6b8e184cb84912e46190ed497326faa8cec11f1969d948adb94ea3
Opcode Fuzzy Hash: 5139c58115fa4b1e7815cd28c69c089ab5c33399aa7050c56c6b4adc2406d397
Instruction Fuzzy Hash: E2513B30A006189FCB14DFA4D494BADB7F2FF88711F24C0A9E906A7364DB389C51CB90

Function 00B62850 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ca3a18d2e181a263592d23226a35ebb7cd84b4d03aa3ca980b52000cf97a7c1
Instruction ID: c81a7e18c9cdb364814c401e53eabb560f54bde97ed2a98d2586c50dac2c4cb1
Opcode Fuzzy Hash: 0ca3a18d2e181a263592d23226a35ebb7cd84b4d03aa3ca980b52000cf97a7c1
Instruction Fuzzy Hash: A0410A74A10208DFDB18EFB5D984AADBBF2FF88300F148169D505A73A8EB359845CF60

Function 00B65308 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334091a2da9659eee8ed8ccfe3aa564fb71dbe6e40563d91f8d44a235c88fa28
Instruction ID: 9bdfe26863a153987173675448ec7d19e0916281e7d9ceee4c65faf19c34138e
Opcode Fuzzy Hash: 334091a2da9659eee8ed8ccfe3aa564fb71dbe6e40563d91f8d44a235c88fa28
Instruction Fuzzy Hash: 5741FD34A00514DFDB04EFA5E494AADB7F2FF88715F2080A5E916A73A4EB389D42CF50

Function 00B62844 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc964dc2317a121480fe940c9cf7797bb0b6520efc7db892985dee01f8c8b2c
Instruction ID: a12a71519dfef3af70551057c5094a958efaa6b3055e431218f138654dc5750b
Opcode Fuzzy Hash: dcc964dc2317a121480fe940c9cf7797bb0b6520efc7db892985dee01f8c8b2c
Instruction Fuzzy Hash: A6311E70A102099FDB18DFB5D984AEDBBF2FFC8340F144579D501A72A8EB399945CB21

Function 00B62C48 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61d43a310a1f1a6340567fe33c73b0635c93ed7794bb25ce9d457a6373aeb6ac
Instruction ID: 79dd4b2fecb37c7336c86e60cd0c460d3092aff19b485fdafa11debf5b2490e7
Opcode Fuzzy Hash: 61d43a310a1f1a6340567fe33c73b0635c93ed7794bb25ce9d457a6373aeb6ac
Instruction Fuzzy Hash: 4D413B34900209CFDB05EFA8D994BEEBBB1FF89314F108165D505A73A8EB349945CF90

Function 00B6B0A0 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f925840f871c5ecafef771c629abd1228cf8db7463cc479a7910c1133bba092b
Instruction ID: d78fb19fd20e8b9fc685e6319d79ae080e3de5c727a4c5ee669bbe7c9854cd3c
Opcode Fuzzy Hash: f925840f871c5ecafef771c629abd1228cf8db7463cc479a7910c1133bba092b
Instruction Fuzzy Hash: 0531E830A002049FDB04EB78D954A9DB7F6FF85310F10852DD01AE73A5EF79AD4A8B91

Function 00B62C58 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad3f9b4c9feb4f4cad9b0d944b9f588d2b57bd068a23f0dc7ff161b2c4b4b202
Instruction ID: 989bedd81fb7dd3d59f03bea31d075579da0a696b81e99d9cf4586d42b4df1dc
Opcode Fuzzy Hash: ad3f9b4c9feb4f4cad9b0d944b9f588d2b57bd068a23f0dc7ff161b2c4b4b202
Instruction Fuzzy Hash: 2F31F934900209CFDB05EFA8D594BEEBBB1FF89314F108165D615A7368EB34A945CF90

Function 00B64B5E Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3560284a17447feb59fc6fe8fd858590dc313b07d02fc00180b27feed8b6a5ce
Instruction ID: d0bf70d8e9f0b4224eb5f04217ad66123ebc7ae43be875e45a8fa7229b18f058
Opcode Fuzzy Hash: 3560284a17447feb59fc6fe8fd858590dc313b07d02fc00180b27feed8b6a5ce
Instruction Fuzzy Hash: AB21A4312042455FC706EB38EA50B6EBBA3EFC0310B558A79D0158B769DF70ED8E8795

Function 00B6288D Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4182c137dd6ef1cb0a85dfe78e1522a04bc633905ed65ad2c72ee134cdac4d1
Instruction ID: 264da44aa30c5e9f523d71cbed5c28a7988613085030e50b7a54554f10884186
Opcode Fuzzy Hash: e4182c137dd6ef1cb0a85dfe78e1522a04bc633905ed65ad2c72ee134cdac4d1
Instruction Fuzzy Hash: 7931E174910208DFDB18DFA4D9946ADBBF2FFC8340F144165D505A7268EB799845CF21

Function 00B6CEC0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f269a8501f15fbfc6cab102148c548c02cd4d91f2f1e46318b6a1a93d4c78a6
Instruction ID: 4cda32e2402fbd8a4b91e0e9bd4c922dbed78ed131c1ad9ce0d70c348ecea3ac
Opcode Fuzzy Hash: 6f269a8501f15fbfc6cab102148c548c02cd4d91f2f1e46318b6a1a93d4c78a6
Instruction Fuzzy Hash: DB215AB1C01248DFDB11CFA8D5587ADBFF2EB48314F2480AAE845A7350DB799948CF91

Function 00B64B80 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b47574b98d5d428e3f1448f4983fa29e201bb44b2cfcd996df696b6482d04e
Instruction ID: 25be71684cb5c21f42ac8da922dad36a53105c698d7c5a6a76f59af1e9dfd8ac
Opcode Fuzzy Hash: b2b47574b98d5d428e3f1448f4983fa29e201bb44b2cfcd996df696b6482d04e
Instruction Fuzzy Hash: E12166312002055FCB15EB79E940A6EB7A6EFC4310B448A38D4158B369DF70FD8E8B95

Function 00B6CED0 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd3c65b9810d84918a5e0062f4a5314cc642736f0634c706b2c28c57a2b318c7
Instruction ID: 23f761afebd5f574c22bef6307cc5ceaa3905252ad58c61f7dfe6a62b8a8c7cc
Opcode Fuzzy Hash: dd3c65b9810d84918a5e0062f4a5314cc642736f0634c706b2c28c57a2b318c7
Instruction Fuzzy Hash: 3C214871D00248DFDB11DFA8D558BADBFF6EB48314F20806AE845A7350DB799845CF91

Function 00B62908 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97535f37366887f9870bcded97420744a4284d3930ccb5bbe52764a0234de0a4
Instruction ID: 4328f11fe583878aeac92d2f2487da88406bfbd5c1fe052773acf9d3f1d9da13
Opcode Fuzzy Hash: 97535f37366887f9870bcded97420744a4284d3930ccb5bbe52764a0234de0a4
Instruction Fuzzy Hash: E621EB75E101099FDB14DFA4D980AADBBF2FFC8340F108165D915A72A8EB749845CF21

Function 00B65C68 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: def727c9795fc85d127c46f3620c3da5b7edb536d0d661084134b1b16a22162c
Instruction ID: 7da342fecae1c7faf4a45ef2f8a30101256e995978f61ff8f189f058643cb2bb
Opcode Fuzzy Hash: def727c9795fc85d127c46f3620c3da5b7edb536d0d661084134b1b16a22162c
Instruction Fuzzy Hash: BE210835A002188FDB14DBA9D588ADDBBF5EF4C310F2400A5E505BB3A1DB79AD84CBA0

Function 00B6296A Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4a996e49683f88cefc225fcd1239effd7aeb4158348df6eb3e9e307bcc1ecc
Instruction ID: 267a704b4125f642213d57ae9a25bd962e246879d0afad159e838560561126fc
Opcode Fuzzy Hash: bc4a996e49683f88cefc225fcd1239effd7aeb4158348df6eb3e9e307bcc1ecc
Instruction Fuzzy Hash: 4B219574A402089FDB14DFA4D984AACBBF6FF89300F204169D915A7368EB349D45CF51

Function 00B66888 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b5f3a0c231cd825410a169732304522eea9266f9549f2e28aef8675c887905
Instruction ID: 5d6eeaa073a264c193e7ff1e76accf0ad93d6a40d0fdd61a6d2559f7372c489d
Opcode Fuzzy Hash: 78b5f3a0c231cd825410a169732304522eea9266f9549f2e28aef8675c887905
Instruction Fuzzy Hash: AB116D72900205CFDB10DBA4C9487EEBBF1AF49305F1084AAD406B7292DB798E45CB51

Function 00B65C5A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e14a69c0024200f9d541b7ba3ee2c4df01d51466b6aa8953b8effeb34ddc0fcd
Instruction ID: 1135700dba0ee35e36ed3070eb460034a58c8fcf9822195edc001cbaf43d0e7d
Opcode Fuzzy Hash: e14a69c0024200f9d541b7ba3ee2c4df01d51466b6aa8953b8effeb34ddc0fcd
Instruction Fuzzy Hash: 08116A35A00618CFDB10CBA9CA98BDDBBF1AF4C314F2500A9D401BB3A0DB799D84CB60

Function 00B641A2 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11c35aa827491331ee22a8af32a70a2f7557f9f4b8ddf8640cbfb288d2d2b20a
Instruction ID: ef54ca888f33fa4bfcc6aebd26b0258b7f50d5c728273fa6e8063fb5c9c1f8ab
Opcode Fuzzy Hash: 11c35aa827491331ee22a8af32a70a2f7557f9f4b8ddf8640cbfb288d2d2b20a
Instruction Fuzzy Hash: C401F5327082855FD7066B355C2427E2FB6EB8625176944AAD405DB392CE304D0EC76A

Function 00B6C000 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b9fa0db887afe3a2188b1fa793b0135e611610122e5a8a917166de977a82a5
Instruction ID: 9c2d3a90a45bfa60d4b1eba7d06bc1265dea685b29ea497d4203c30226f24be9
Opcode Fuzzy Hash: 74b9fa0db887afe3a2188b1fa793b0135e611610122e5a8a917166de977a82a5
Instruction Fuzzy Hash: 2A018C313101158FCB44EF28E984E99BBF1FF85B14B1185A9E105CB376EB31EE4A8B80

Function 00B632E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df45385229ade1d463be20c8cf69bd352d0c46c038d109b9b3cb521c5b262ab2
Instruction ID: 995cee01733ce5b91854e434a1e56baed58cb9900db52362d611bd9f68e2898e
Opcode Fuzzy Hash: df45385229ade1d463be20c8cf69bd352d0c46c038d109b9b3cb521c5b262ab2
Instruction Fuzzy Hash: FE115B34A14284CFEB05EFB8E968BAE7FF2AB89301F044469D502A73A5DF385905CB51

Function 00B65940 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6046a35d09d96348fc9840f107ad603dc110aa7820b045e000140152beba6182
Instruction ID: 5167138f371708b77a713f381b13290e22a6ae49d2ded3b17b819d423307bf38
Opcode Fuzzy Hash: 6046a35d09d96348fc9840f107ad603dc110aa7820b045e000140152beba6182
Instruction Fuzzy Hash: 80013C763002248B8704AB69E89496AB7FAEBC9761315857AEA06C7351DE319C06D7A0

Function 00B62A80 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a355d4b1f79d1160a498bf15c1809ab49d7288963ea605d6be94477f8a3fac5
Instruction ID: df55b15c3af0460a503f5b453629add8cc301f5f10863306b77ac63a5423b0b2
Opcode Fuzzy Hash: 9a355d4b1f79d1160a498bf15c1809ab49d7288963ea605d6be94477f8a3fac5
Instruction Fuzzy Hash: 5101BC766007008FCB129B38C60855ABBE2EF8231472589EAD14ACF325DF30EC088BC1

Function 00B632F0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24ec08b592afda52e09d5c831fabbd585ed8672a5108e22d972149b942c4d5cb
Instruction ID: c3b1bb5acd000ae623376e798f4752866c1b15570c84cb7a463d492001824506
Opcode Fuzzy Hash: 24ec08b592afda52e09d5c831fabbd585ed8672a5108e22d972149b942c4d5cb
Instruction Fuzzy Hash: CB011E34A10244CFEB04EFB8E958BAE7BF2EB89301F008469D502973A5DF395845CB51

Function 00B65931 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c69ac057489773e69edaf248df4dfe2246ee9ade4a171fc625e69c73e9bac71
Instruction ID: ec491bf2c163a809ab4e53701330fe4107a3228a73d043d72ccd4a9b1b208f3c
Opcode Fuzzy Hash: 3c69ac057489773e69edaf248df4dfe2246ee9ade4a171fc625e69c73e9bac71
Instruction Fuzzy Hash: B2F096777011148FC704EB29E894E6A7BB6EBD936571681BEE909C7361DA309C06C7A0

Function 00B66388 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed268d6d7b143e77b786be85f78b1c69efdba85c8a5fc61bdd32a9601410c879
Instruction ID: c7b8d7bf97f9ce48a80112acc2f1cadc158a9bec4e1e8ddfd536fd53e6fd4991
Opcode Fuzzy Hash: ed268d6d7b143e77b786be85f78b1c69efdba85c8a5fc61bdd32a9601410c879
Instruction Fuzzy Hash: 62F04975905288AFCF01EBB4E9519ACBFB2DF56200B1181EAD849EB262DA305E4DCB41

Function 00B641E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 995840ba4c8198a07926edc8530a917456b55b7bc64d7a543a9df573235e9bbe
Instruction ID: b360d99b332bd35658b8b58f233cda662b18ec29939a8876c098d20ae5ad2f19
Opcode Fuzzy Hash: 995840ba4c8198a07926edc8530a917456b55b7bc64d7a543a9df573235e9bbe
Instruction Fuzzy Hash: 1FE0E5327041082F8B08A6A66D5197F6AEAEBC82607540839F109D7340DF316D0A47A9

Function 00B66398 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f451afd0f429fa4ab879ed18848c0281c5bd5473b52dd1e3d031b1329efa96f
Instruction ID: 21bdb48f16b0f66d7cf20e5a3dc5f5d92e38801de7f747e5b31e1ab2ef5abe00
Opcode Fuzzy Hash: 4f451afd0f429fa4ab879ed18848c0281c5bd5473b52dd1e3d031b1329efa96f
Instruction Fuzzy Hash: 4BF01235A0020DEFCF44EFA8D941A6DBBF6DF84300F1041A89909A7354DA305F49DB51

Function 00B62D94 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a739f1f921da956019bfb92e204c16a320ae7fd72131dd0e83aebf563853eba3
Instruction ID: 2b73b3d070373a51f13a37ef5f6667bd5480b1c4141ac892bbdcc096a0c0ff78
Opcode Fuzzy Hash: a739f1f921da956019bfb92e204c16a320ae7fd72131dd0e83aebf563853eba3
Instruction Fuzzy Hash: 17F05E72E141188FC754EFB885055DD7BF0EB89300B2140BAD109D7251EB308D048B82

Function 00B6CFE0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35288ac8ba3dd5bd5d6993104bd1f7b81179563059457d876747ee8ad0e7c6fd
Instruction ID: f6eda832253880b318da03dfbd561bd4b854fc18909720083425c79c2648ce4b
Opcode Fuzzy Hash: 35288ac8ba3dd5bd5d6993104bd1f7b81179563059457d876747ee8ad0e7c6fd
Instruction Fuzzy Hash: 5AE0923590A3405BEB22069175343B03FA5DB42319F1980DAD88D4BBD2E7EE4C8AE792

Function 00B62DA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d76c65e09a6e0c778fd94b9d2e138350695d7e1fca8fc30dc45348bdbcfed23
Instruction ID: eeb31618bd0b37ecba1a03c35ccc80775002133da8bea1b729af3fc56cc41de2
Opcode Fuzzy Hash: 1d76c65e09a6e0c778fd94b9d2e138350695d7e1fca8fc30dc45348bdbcfed23
Instruction Fuzzy Hash: 81E0C971E101188F8B84EFBD95056EE7BF5EB49311B2140BAE619E7311EA709E018B91

Function 00B61FF8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532bcede17e056fdddf276282560526110f257c64bd2107b1cb86a12dde3df2c
Instruction ID: c9840231c03fffd0cea0f5ee0526ffe3b8211e077553ad1f5cd29286058a7bbc
Opcode Fuzzy Hash: 532bcede17e056fdddf276282560526110f257c64bd2107b1cb86a12dde3df2c
Instruction Fuzzy Hash: 09E092393042808FDB125778D828A697FE6DFC7215B0A04EAE045CB772CE748C01C761

Function 00B6374E Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c83f90f4d5a55d325462d2bb93665b0b91996b02610ff483aa13391fda4b18b
Instruction ID: d69cbc0a066a914dd466b2202e3d8147026f7323af1ce89ec5bada6e137e1ebe
Opcode Fuzzy Hash: 2c83f90f4d5a55d325462d2bb93665b0b91996b02610ff483aa13391fda4b18b
Instruction Fuzzy Hash: A2D0C27B7001104783299665A904A7B22F7DBC862132D402ADD09C3324EE388E0B53A1

Function 00B637EE Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5092c28f68c34a868beb0d07b796aa427320e413b3318ffebd7525ca5a74fdc
Instruction ID: 0fe46f527d55adc4d09373b1372d9b140995c2cc9cf8bbf1563fddc2291e0737
Opcode Fuzzy Hash: f5092c28f68c34a868beb0d07b796aa427320e413b3318ffebd7525ca5a74fdc
Instruction Fuzzy Hash: 8CD02B3330010057D71456596C00AB722EBE7C8335B18402AFA08C3220FE759C024390

Function 00B666C8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff56d8382eacf146aa5699ce084a729236e977f607c5198118b53c6adf4d7b5
Instruction ID: 2c6d2b00dd72fa0766be6c9f5922d9c857be6c3ad9ce5a99d33b1b2b7ba4af89
Opcode Fuzzy Hash: 6ff56d8382eacf146aa5699ce084a729236e977f607c5198118b53c6adf4d7b5
Instruction Fuzzy Hash: ECD01233B041701BD705325C78143FD26D6CBC9262F4A01B7F615E7356CD648D075795

Function 00B66469 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff181d870b709bea4aa403b4aaa7b5bcb40bd6332e95ead7d7fba11d8f50d8a
Instruction ID: 097a29ae5f21cc83fa443fe48a060a0903c46e31876a47825510bb036e4fd652
Opcode Fuzzy Hash: 3ff181d870b709bea4aa403b4aaa7b5bcb40bd6332e95ead7d7fba11d8f50d8a
Instruction Fuzzy Hash: 38D05E7AA496804FCB05D728E0909547BB2AF9931071605E9E55ACB3BAD924CC86CB05

Function 00B66478 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca6774fa8d5fda18a68568272a4bf44102ab4a8a23db0af5f27e2370ac0c5fe
Instruction ID: d529a790d194382e8e93eee3ff3b01800808f6dcb4460e2b8f434dab16cc0133
Opcode Fuzzy Hash: aca6774fa8d5fda18a68568272a4bf44102ab4a8a23db0af5f27e2370ac0c5fe
Instruction Fuzzy Hash: B2C012353802088FC708EB6CE080C25B3FAABCC71031044B8E619CB339DE20EC828A18

Function 00B65640 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c55110c4ab3520c0b9919b90a9505f7fddf10f8a28b75e18e18b44bbb373269b
Instruction ID: 05470ce5e5fa6ddd1b998ee0b22856f3cd0760bc18d94e455e27cc08bf9cdbe5
Opcode Fuzzy Hash: c55110c4ab3520c0b9919b90a9505f7fddf10f8a28b75e18e18b44bbb373269b
Instruction Fuzzy Hash: BCB02B3010020957C6100625FC088213B1DEB4011474001D4AC0C02110ED23E8208081

Function 00B6CAA0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.3468536122.0000000000B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_b60000_GamePall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a24a11e2a69ca79b229a159f148e4c3e25387b9bf4f7566e2eea9aa219d52d0
Instruction ID: 24b98469c34045e2d20c152f7894e134852a1828ab3cfcdbe16b9dd396bbbad6
Opcode Fuzzy Hash: 9a24a11e2a69ca79b229a159f148e4c3e25387b9bf4f7566e2eea9aa219d52d0
Instruction Fuzzy Hash: 9CB092E3DA18806AFA404990A9A97803360D720703F410260900994A80B058B6024D1A

Non-executed Functions

Function 604AE130 Relevance: 18.2, APIs: 12, Instructions: 162threadtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 604AE6C0: GetCurrentThread.KERNEL32 ref: 604AE6C7

QueryThreadCycleTime.KERNEL32(00000000,00000000), ref: 604AE170
GetCurrentThread.KERNEL32 ref: 604AE1F7
GetThreadPriority.KERNEL32(00000000), ref: 604AE1FA
GetCurrentThread.KERNEL32 ref: 604AE204
SetThreadPriority.KERNEL32(00000000,00000002), ref: 604AE209
QueryPerformanceCounter.KERNEL32(?), ref: 604AE267
GetCurrentThread.KERNEL32 ref: 604AE276
SetThreadPriority.KERNEL32(00000000,?), ref: 604AE281
QueryPerformanceFrequency.KERNEL32(?), ref: 604AE28F
__Init_thread_header.LIBCMT ref: 604AE2F3
__Init_thread_header.LIBCMT ref: 604AE371
QueryPerformanceCounter.KERNEL32(?), ref: 604AE392

Part of subcall function 604CCFDD: EnterCriticalSection.KERNEL32(60566154,?,?,604FE6B4,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D,?), ref: 604CCFE7
Part of subcall function 604CCFDD: LeaveCriticalSection.KERNEL32(60566154,?,604FE6B4,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D,?), ref: 604CD01A
Part of subcall function 604CCFDD: WakeAllConditionVariable.KERNEL32(?,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D,?,?,?,604B2085), ref: 604CD08D

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: Thread$CurrentQuery$PerformancePriority$CounterCriticalInit_thread_headerSection$ConditionCycleEnterFrequencyLeaveTimeVariableWake
String ID:
API String ID: 1831388462-0
Opcode ID: f8ba9a6f7c27788cf0cd7c8f4efd0ecf9d1eeb36953afb5d9e0bb415c09b0cbe
Instruction ID: a9ccffaf3cba59462507087b385c66bee3a7edbddf8e2bbdde33e05808d7fb76
Opcode Fuzzy Hash: f8ba9a6f7c27788cf0cd7c8f4efd0ecf9d1eeb36953afb5d9e0bb415c09b0cbe
Instruction Fuzzy Hash: 05618071518701DFC712DF39C88595ABFB4FFBA340F128B2AE895A2261EB359841DB42

Function 605221E0 Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 282COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6052221C

Strings

false, xrefs: 60522471
"Unsupported (crbug.com/1225176)", xrefs: 6052229E
NULL, xrefs: 60522213, 6052221B, 6052222C, 60522292
Infinity, xrefs: 60522508
"-Infinity", xrefs: 605224D1, 605224E8
%lld, xrefs: 60522259
%s:%d: assertion %s failed: %s, xrefs: 60522532
0x%llx, xrefs: 60522239, 60522247
"Infinity", xrefs: 60522503
-Infinity, xrefs: 605224D2, 605224ED
"0x%llx", xrefs: 60522234
string index out of bounds, xrefs: 6052251E
true, xrefs: 60522476, 60522484
..\..\third_party\libc++\src\include\string, xrefs: 6052252D
"NaN", xrefs: 605224B4
%llu, xrefs: 6052226C
__pos <= size(), xrefs: 60522523
NaN, xrefs: 605224B9

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: _strlen
String ID: "-Infinity"$"0x%llx"$"Infinity"$"NaN"$"Unsupported (crbug.com/1225176)"$%lld$%llu$%s:%d: assertion %s failed: %s$-Infinity$..\..\third_party\libc++\src\include\string$0x%llx$Infinity$NULL$NaN$__pos <= size()$false$string index out of bounds$true
API String ID: 4218353326-2785851941
Opcode ID: 4e32ef367f5bd1e2fbf32c2606e12e9c81f37a5d552e5555d0eae0af3dc32a6e
Instruction ID: ed226d8dadff397e0f6cb7102220ae0ada20f867788e667602c08015a0cf6c16
Opcode Fuzzy Hash: 4e32ef367f5bd1e2fbf32c2606e12e9c81f37a5d552e5555d0eae0af3dc32a6e
Instruction Fuzzy Hash: 6F915879A58310BADB10CE24AC40F6A7FD6AFB6388F104D2DF8849B1D1E7358D059292

Function 604702F0 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 158COMMON

Download Yara Rule

APIs

__Init_thread_header.LIBCMT ref: 60470642

Strings

Tuesday, xrefs: 60470396
XW`, xrefs: 60470328
\XW`, xrefs: 60470412
Monday, xrefs: 60470368
tXW`, xrefs: 6047046C
hXW`, xrefs: 60470442
PXW`, xrefs: 604703E8
DXW`, xrefs: 604703B6
rday, xrefs: 60470447
Sunday, xrefs: 60470338
8XW`, xrefs: 60470388
Friday, xrefs: 60470422
,XW`, xrefs: 60470358

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: Init_thread_header
String ID: XW`$,XW`$8XW`$DXW`$Friday$Monday$PXW`$Sunday$Tuesday$\XW`$hXW`$rday$tXW`
API String ID: 3738618077-3713428989
Opcode ID: 97c42054eaaf0d2d0ba09cf7a5e5f86a027fc228b24b603907b44c0880b966a3
Instruction ID: 9b2247f653994a24708852c55cb874f0188d2255a340decca00e52202fd85c32
Opcode Fuzzy Hash: 97c42054eaaf0d2d0ba09cf7a5e5f86a027fc228b24b603907b44c0880b966a3
Instruction Fuzzy Hash: 0081DA709092A4CFEB26CB18C954B043FE1A733304F6A8199D4446F3B1D7FA9989EB57

Function 60478110 Relevance: 23.0, APIs: 1, Strings: 12, Instructions: 272COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000001,?,?,?,?,?,?,?,00000000), ref: 6047827D

Part of subcall function 604840E0: ExpandEnvironmentStringsW.KERNEL32(?,?,00000400,?,?,?,80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000001), ref: 604841A2

Strings

DisplayVersion, xrefs: 604781A7
UBR, xrefs: 60478197
ReleaseId, xrefs: 60478346
null pointer passed to non-null argument of char_traits<...>::length, xrefs: 60478490
%s:%d: assertion %s failed: %s, xrefs: 604784A4
__len <= static_cast<size_type>(numeric_limits<difference_type>::max()), xrefs: 60478484
..\..\third_party\libc++\src\include\string_view, xrefs: 6047849F
string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 6047846E
__len == 0 || __s != nullptr, xrefs: 60478473
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 6047817E
string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 6047847F
__s != nullptr, xrefs: 60478495

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CurrentEnvironmentExpandProcessStrings
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\string_view$DisplayVersion$ReleaseId$SOFTWARE\Microsoft\Windows NT\CurrentVersion$UBR$__len <= static_cast<size_type>(numeric_limits<difference_type>::max())$__len == 0 || __s != nullptr$__s != nullptr$null pointer passed to non-null argument of char_traits<...>::length$string_view::string_view(_CharT *, size_t): length does not fit in difference_type$string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 2339647510-1199739361
Opcode ID: 5e1c54f73b07a36956e92b99f360ac53558dca81faf692c602a534263711f0bc
Instruction ID: de6bfaa05ecb115f578e8fc585d5f68e320d8d2356e8f85db87c3ceef3aaabd6
Opcode Fuzzy Hash: 5e1c54f73b07a36956e92b99f360ac53558dca81faf692c602a534263711f0bc
Instruction Fuzzy Hash: 13A1B0709442049FDB34CF28C880EDABFF1AF65714F14856EE849EB241E7B9D9468B92

Function 6049A250 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32(605771C8,6049A0E0,?,00000000,00000000,6049A570,?,?,00000130), ref: 6049A279
GetLastError.KERNEL32(?,?,00000130), ref: 6049A297
TlsGetValue.KERNEL32(?,?,00000130), ref: 6049A2A5
SetLastError.KERNEL32(00000000,?,?,00000130), ref: 6049A2AE
TlsSetValue.KERNEL32(00000000,?,?,?,?,?,?,00000130), ref: 6049A2D1
AcquireSRWLockExclusive.KERNEL32(605771D4,?,?,00000130), ref: 6049A2E4
ReleaseSRWLockExclusive.KERNEL32(605771D4,?,?,00000130), ref: 6049A2F5
LoadLibraryW.KERNEL32(bcryptprimitives,?,?,?,00000130), ref: 6049A348
GetProcAddress.KERNEL32(00000000,ProcessPrng), ref: 6049A358

Strings

ProcessPrng, xrefs: 6049A352
bcryptprimitives, xrefs: 6049A343

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ErrorExclusiveLastLockOnceValue$AcquireAddressExecuteInitLibraryLoadProcRelease
String ID: ProcessPrng$bcryptprimitives
API String ID: 1967882921-1205050517
Opcode ID: 9982944fb7a435d84e5dbb2ba303c5da7410ab67c8fa04fb85f90eab1de7b9a1
Instruction ID: 82c668bcdb5cf36d655a26834a14e77681a050e055721b49baeee29e33ef5fb5
Opcode Fuzzy Hash: 9982944fb7a435d84e5dbb2ba303c5da7410ab67c8fa04fb85f90eab1de7b9a1
Instruction Fuzzy Hash: 66318174900219ABDB216FA5DC49EAA3F68FF67715F814034FC05A6351EB359D20CBE1

Function 604640F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(00000030,?,00000000,?,60464838,?,?,?,?,?,?,?,?,?,?), ref: 60464118
SleepConditionVariableSRW.KERNEL32(00000034,00000030,00000000,00000000,?,60464838,?,?,?,?,?,?,?,?,?,?), ref: 60464137
ReleaseSRWLockExclusive.KERNEL32(00000030,?,60464838,?,?,?,?,?,?,?,?,?,?,?,604FC016), ref: 60464152
GetLastError.KERNEL32(?,60464838,?,?,?,?,?,?,?,?,?,?,?,604FC016), ref: 60464176
AcquireSRWLockExclusive.KERNEL32(?,00000030,?,?,?,?,?,?,?,?,?,60464838,?), ref: 604641A7
WakeConditionVariable.KERNEL32(?,?,00000030,?,?,?,?,?,?,?,?,?,60464838,?), ref: 604641BA
ReleaseSRWLockExclusive.KERNEL32(?,?,00000030,?,?,?,?,?,?,?,?,?,60464838,?), ref: 604641C1

Strings

SleepConditionVariableSRW failed: %lu, xrefs: 60464188
win32_waiter.cc, xrefs: 6046418F

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionReleaseVariable$ErrorLastSleepWake
String ID: SleepConditionVariableSRW failed: %lu$win32_waiter.cc
API String ID: 4254592985-2919041413
Opcode ID: 59f287135781e49aa5a3f55aceca209acffea5d742c90f877764d8e5615bc5bc
Instruction ID: 3ece8d62604239b55d284b61b6ba5ec0a2aacdabf3cb65e0a7df39f6a656a067
Opcode Fuzzy Hash: 59f287135781e49aa5a3f55aceca209acffea5d742c90f877764d8e5615bc5bc
Instruction Fuzzy Hash: CD21F771600704AFD724AF65CC48EDB7FA8EFA7364F40842DF45AD2241EB34A840CB91

Function 6048A050 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6047BAE7,CHROME_CRASHPAD_PIPE_NAME,00000019,?,?), ref: 6048A0BE
SetEnvironmentVariableW.KERNEL32(?,00000000,?,?,?,..\..\third_party\libc++\src\include\string_view,0000013A,__len <= static_cast<size_type>(numeric_limits<difference_type>::max()),string_view::string_view(_CharT *, size_t): length does not fit in difference_type,?,?,?,6047BAE7,CHROME_CRASHPAD_PIPE_NAME,00000019,?), ref: 6048A173

Strings

%s:%d: assertion %s failed: %s, xrefs: 6048A128
string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 6048A103
..\..\third_party\libc++\src\include\string_view, xrefs: 6048A123
__len <= static_cast<size_type>(numeric_limits<difference_type>::max()), xrefs: 6048A119
__len == 0 || __s != nullptr, xrefs: 6048A108
string_view::string_view(_CharT *, size_t): length does not fit in difference_type, xrefs: 6048A114

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: EnvironmentVariable
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\string_view$__len <= static_cast<size_type>(numeric_limits<difference_type>::max())$__len == 0 || __s != nullptr$string_view::string_view(_CharT *, size_t): length does not fit in difference_type$string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 1431749950-2671331263
Opcode ID: 79e5b8813e73686ac06bc330ff17f01b07b658803072c7215a82688ddb6663f0
Instruction ID: d8f62a4eaa287039b84c39434ec034dcbd11d7ef30ca282601305052753fda62
Opcode Fuzzy Hash: 79e5b8813e73686ac06bc330ff17f01b07b658803072c7215a82688ddb6663f0
Instruction Fuzzy Hash: 1031F372D042286BEB259B90CC05FAF7F74AF26318F04842DF90537281D779AA6587D2

Function 605161F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 175fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 60516269
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 605162A5
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 605162EF
CreateFileW.KERNEL32 ref: 605163E1
__Init_thread_header.LIBCMT ref: 60516435

Part of subcall function 604CCF67: EnterCriticalSection.KERNEL32(60566154,?,?,?,604FE691,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D), ref: 604CCF72
Part of subcall function 604CCF67: LeaveCriticalSection.KERNEL32(60566154,?,604FE691,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D,?), ref: 604CCFAF

Part of subcall function 604CCFDD: EnterCriticalSection.KERNEL32(60566154,?,?,604FE6B4,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D,?), ref: 604CCFE7
Part of subcall function 604CCFDD: LeaveCriticalSection.KERNEL32(60566154,?,604FE6B4,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D,?), ref: 604CD01A
Part of subcall function 604CCFDD: WakeAllConditionVariable.KERNEL32(?,60575234,?,604FE72A,?,?,6046B0B9,ios_base::clear,?,?,?,6049F89D,?,?,?,604B2085), ref: 604CD08D

Strings

LoW`, xrefs: 6051645D
debug.log, xrefs: 60516350, 605163A8

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CriticalSection$File$CreateEnterLeave$ConditionCurrentDirectoryInit_thread_headerModuleNameVariableWake
String ID: LoW`$debug.log
API String ID: 1936484898-137816879
Opcode ID: e28a8462a94f27960c5bc5f0991c21d7fde89dfef0e437356b2d65e99e9bd546
Instruction ID: 0f7cf1ffb95224ee992bdea6e17a10b43e1f92a21596261e209e3bfd3a5a92fe
Opcode Fuzzy Hash: e28a8462a94f27960c5bc5f0991c21d7fde89dfef0e437356b2d65e99e9bd546
Instruction Fuzzy Hash: A45104709043108BEB20EF649C45B6E7FE0EFB6708F11499CE5656B295EB7468C48BD2

Function 604980E0 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 157COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?), ref: 60498205
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,?,60497E78,60492814,?,60492814,?), ref: 60498264

Strings

__location != nullptr, xrefs: 6049828A
..\..\third_party\libc++\src\include\__memory\construct_at.h, xrefs: 60498291
null pointer given to destroy_at, xrefs: 60498277
__loc != nullptr, xrefs: 6049827C
%s:%d: assertion %s failed: %s, xrefs: 60498296
null pointer given to construct_at, xrefs: 60498285

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ErrorFreeLastLocal
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\__memory\construct_at.h$__loc != nullptr$__location != nullptr$null pointer given to construct_at$null pointer given to destroy_at
API String ID: 3928016487-1414239786
Opcode ID: a0fe2587ebd06d3ac70082572807164c9ce91051e8024f9a0f381e6857368a37
Instruction ID: dfc276d790485d3ecca6a931b4850d03ed5dcc938920f4873ab3f8ccaea3d14c
Opcode Fuzzy Hash: a0fe2587ebd06d3ac70082572807164c9ce91051e8024f9a0f381e6857368a37
Instruction Fuzzy Hash: AD51C1B1D006149FDB14CFA9CC84EAEBFB5EFA9304F10417DE805A7350E77999418BA1

Function 604EC051 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 604EC0D7

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 5e558e28cd5b0b8d24ebe8efc3243449e27dd7fc0835bb39817d3425118a5633
Instruction ID: 665fbe1c66f5027a43ed64a65a14c071d2dd1a39a30c47c50c2ac0b2b70d88a6
Opcode Fuzzy Hash: 5e558e28cd5b0b8d24ebe8efc3243449e27dd7fc0835bb39817d3425118a5633
Instruction Fuzzy Hash: 0EB17972D043559FDB218FA5CC81FAEBFA5EF66345F104995E900AB381D3789903CBA1

Function 60524010 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 219COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 605240F8
_strlen.LIBCMT ref: 60524207

Strings

null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6052424C
%s:%d: assertion %s failed: %s, xrefs: 60524260
..\..\third_party\libc++\src\include\string_view, xrefs: 6052425B
__s != nullptr, xrefs: 60524251

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: _strlen
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\string_view$__s != nullptr$null pointer passed to non-null argument of char_traits<...>::length
API String ID: 4218353326-3330642834
Opcode ID: c78e8d8ed1de74b3165c984d9c3eb73fa908159aee7630003775a44113bc2f32
Instruction ID: d8365c6229fc274b0de01bdaff8568e4237041c2a472268b2e3c0c79df079405
Opcode Fuzzy Hash: c78e8d8ed1de74b3165c984d9c3eb73fa908159aee7630003775a44113bc2f32
Instruction Fuzzy Hash: C481A0B5D00229AFDB11CFA4E885A9EBFB1BF29314F044019E918BB341D734A995CFD1

Function 6048A1B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,00000000,00000000,?,?,?,00000000,?,60489F35,6047B022,00000000,00000000,?,6047B022,CHROME_CRASHPAD_PIPE_NAME,00000019), ref: 6048A1E3
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 6048A242

Strings

null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6048A2BA
%s:%d: assertion %s failed: %s, xrefs: 6048A2CE
..\..\third_party\libc++\src\include\string_view, xrefs: 6048A2C9
__s != nullptr, xrefs: 6048A2BF

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: EnvironmentVariable
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\string_view$__s != nullptr$null pointer passed to non-null argument of char_traits<...>::length
API String ID: 1431749950-3330642834
Opcode ID: 2dba5185c5fcc8e47145a72eb09d7a373099a3e3aa7284e06d4cf5c9ded5bd58
Instruction ID: ed1bbbbb55a059ae2b252adec59196c75d983c869e88ff0fd37dd0896eae7c67
Opcode Fuzzy Hash: 2dba5185c5fcc8e47145a72eb09d7a373099a3e3aa7284e06d4cf5c9ded5bd58
Instruction Fuzzy Hash: D531F6B1D002146BEB329B64DC45FBF7B68DF76308F04446DFC06A6281EB79991982E2

Function 605201C0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 60520010: TryAcquireSRWLockExclusive.KERNEL32(?,00000000,?,00000004), ref: 60520038
Part of subcall function 60520010: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00000004), ref: 60520063

_strlen.LIBCMT ref: 605201F3

Strings

type, xrefs: 6052029F
null pointer passed to non-null argument of char_traits<...>::length, xrefs: 6052023F
%s:%d: assertion %s failed: %s, xrefs: 60520253
..\..\third_party\libc++\src\include\string_view, xrefs: 6052024E
__s != nullptr, xrefs: 60520244

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease_strlen
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\string_view$__s != nullptr$null pointer passed to non-null argument of char_traits<...>::length$type
API String ID: 1083709183-563373429
Opcode ID: 10a8190571fc898d00c1e23644beb0ed593edaf1fa82ace3c7cef9cdd6dd6faa
Instruction ID: ab4a231a111645c424b72f2bb10b39608b891859cb3d2fb2b7de5f88e92cdc8b
Opcode Fuzzy Hash: 10a8190571fc898d00c1e23644beb0ed593edaf1fa82ace3c7cef9cdd6dd6faa
Instruction Fuzzy Hash: DF31D175A002196BCB149BA5EC4AEAFBF68EFA5718F400129F90977280EB706D14C7E1

Function 604C8040 Relevance: 9.2, APIs: 6, Instructions: 182COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,604C94F3,?,3D44E3B6,6049AEA5,?), ref: 604C809A
ReleaseSRWLockExclusive.KERNEL32(?,?,604C94F3,?,3D44E3B6,6049AEA5,?), ref: 604C80B1
TryAcquireSRWLockExclusive.KERNEL32(?,?,604C94F3,?,3D44E3B6,6049AEA5,?), ref: 604C80B8
ReleaseSRWLockExclusive.KERNEL32(?,?,604C94F3,?,3D44E3B6,6049AEA5,?), ref: 604C80DE
TryAcquireSRWLockExclusive.KERNEL32(?,?,?,604C94F3,?,3D44E3B6,6049AEA5,?), ref: 604C8101
ReleaseSRWLockExclusive.KERNEL32(?,?,604C94F3,?,3D44E3B6,6049AEA5,?), ref: 604C8118

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 8d97e24de4a1e3f4b3e7b5a8f0a91b625ff85bd7530650c71a0b389be3a3725b
Instruction ID: e6e0ac337e9d99a8006bdcc2479298cee05724e843bb3efebccfc2717d98547a
Opcode Fuzzy Hash: 8d97e24de4a1e3f4b3e7b5a8f0a91b625ff85bd7530650c71a0b389be3a3725b
Instruction Fuzzy Hash: 6051F739E001188FCB309F68C885AAEBBB2BFA6314F06451CE55577350CB78AD06CBD2

Function 604B82D0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 604B82E2
CloseHandle.KERNEL32(?), ref: 604B8312

Strings

%s:%d: assertion %s failed: %s, xrefs: 604B83DE
string_view::string_view(_CharT *, size_t): received nullptr, xrefs: 604B83B9
..\..\third_party\libc++\src\include\string_view, xrefs: 604B83D9
__len == 0 || __s != nullptr, xrefs: 604B83BE

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CloseHandle
String ID: %s:%d: assertion %s failed: %s$..\..\third_party\libc++\src\include\string_view$__len == 0 || __s != nullptr$string_view::string_view(_CharT *, size_t): received nullptr
API String ID: 2962429428-1530698177
Opcode ID: 09c4b8a9bce9849ad1c3990e9d933884e493b1023291550af20d5bb67dee2208
Instruction ID: 5122385ebb3631e18e2df39c2a0d479ecc6039991b1e19fab210977320407386
Opcode Fuzzy Hash: 09c4b8a9bce9849ad1c3990e9d933884e493b1023291550af20d5bb67dee2208
Instruction Fuzzy Hash: 87314B3560421B8BEB398F15C840EA67BE6EFB1B04F10541CED1657B00E3B5AC81C7B0

Function 6049A100 Relevance: 7.6, APIs: 5, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNEL32(605771C8,Function_0004A0E0,?,00000000), ref: 6049A146
TlsGetValue.KERNEL32 ref: 6049A163
AcquireSRWLockExclusive.KERNEL32(605771D4), ref: 6049A175
ReleaseSRWLockExclusive.KERNEL32(605771D4), ref: 6049A1A5

Part of subcall function 604E08C6: IsProcessorFeaturePresent.KERNEL32(00000017,604D226B), ref: 604E08E2

TlsAlloc.KERNEL32 ref: 6049A233

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLockOnce$AcquireAllocExecuteFeatureInitPresentProcessorReleaseValue
String ID:
API String ID: 2915141342-0
Opcode ID: 40bdfe81c77b0b7cf81f34a1b80ee58675dd89495d712be05efea8b964ff0b95
Instruction ID: d194a1103b1f66837f60803310473e1ded6e5fe12bcc7dad7f6c86cceb3d207b
Opcode Fuzzy Hash: 40bdfe81c77b0b7cf81f34a1b80ee58675dd89495d712be05efea8b964ff0b95
Instruction Fuzzy Hash: 43319075A002188FDF14AFA4DC89A6E7FB4FF66210B42403DEC16A3350DB39A955DBA1

Function 604C40D0 Relevance: 6.1, APIs: 4, Instructions: 149COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(FFFFFFFF,6049A230,?,?), ref: 604C40F9
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 604C4209
ReleaseSRWLockExclusive.KERNEL32(?), ref: 604C4231
__Init_thread_header.LIBCMT ref: 604C42C6

Part of subcall function 6049D4A0: TlsSetValue.KERNEL32(FFFFFFFF,604C413B,?,604C413B,FFFFFFFF,?), ref: 6049D4A9

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLockValue$AcquireInit_thread_headerRelease
String ID:
API String ID: 4057198150-0
Opcode ID: c368f0196f5cc9b127dc29c1c659e4bccc84c85437c02d93ee761ec4b2df4954
Instruction ID: 044f3878cf09963dc9528f7df4b804621acfbec299ee56f87f58d74b7289b2cb
Opcode Fuzzy Hash: c368f0196f5cc9b127dc29c1c659e4bccc84c85437c02d93ee761ec4b2df4954
Instruction Fuzzy Hash: F4515A79A002044BEB309F54EC4AFA93B65BFB5348F144578E95953381DB785E84CBD3

Function 60514150 Relevance: 6.1, APIs: 4, Instructions: 146COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?), ref: 60514180

Part of subcall function 604B38D0: AcquireSRWLockExclusive.KERNEL32(?,?,6047D907,?,?,?,?,?,__len <= static_cast<size_type>(numeric_limits<difference_type>::max()),string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 604B38D4

ReleaseSRWLockExclusive.KERNEL32(?), ref: 605141FD
TryAcquireSRWLockExclusive.KERNEL32(?), ref: 60514266
ReleaseSRWLockExclusive.KERNEL32(?), ref: 605142ED

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID:
API String ID: 1678258262-0
Opcode ID: cdfbf339997ee956591f1198a00376d601ad17d99d54f37e56c4d73f92181880
Instruction ID: cffa1869f83eef6802552513f20645083ea3250ee5bafe014513240e5f026206
Opcode Fuzzy Hash: cdfbf339997ee956591f1198a00376d601ad17d99d54f37e56c4d73f92181880
Instruction Fuzzy Hash: 425170B4A043058FEB24DF64D894A6BBBF5FFA9308B00056CE41697751DB34ED89CBA1

Function 604AE010 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(00000000), ref: 604AE03F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 604AE07C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 604AE0B2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 604AE116

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$CounterPerformanceQuery
String ID:
API String ID: 374826692-0
Opcode ID: c2e3a514ed9b96e1e1d5912345947c7183ff73ad3909af30d3cfa3c72c0b8f0a
Instruction ID: 6324c14cb5daf184d3b43d44f766cb7c28233c986089122c3233bb3bbfe88459
Opcode Fuzzy Hash: c2e3a514ed9b96e1e1d5912345947c7183ff73ad3909af30d3cfa3c72c0b8f0a
Instruction Fuzzy Hash: 7B314CB1608305AFC708DF58D88592BFFE9EBD9314F01882EF588C7361E774A8449B92

Function 6048C240 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6048C257

Strings

Free, xrefs: 6048C27C
..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc, xrefs: 6048C277
CloseHandle, xrefs: 6048C299

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CloseHandle
String ID: ..\..\third_party\crashpad\crashpad\util\win\scoped_handle.cc$CloseHandle$Free
API String ID: 2962429428-1704384866
Opcode ID: 672efac74225cf8741ca7f9016fb348bc35fb2eba10f0273eecbe38a18b1387a
Instruction ID: 4412006ab578923c4b5b721b3b9f3da417d1aaeaf5d06ef1b0a08617e205dcec
Opcode Fuzzy Hash: 672efac74225cf8741ca7f9016fb348bc35fb2eba10f0273eecbe38a18b1387a
Instruction Fuzzy Hash: D5F09C71E40118679F186799DC0ACAE7F69DFF7648B40045DF80A7B242EB34595487E2

Function 60482190 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,?,6051440E,00000001,?,?,?,?,?,605142EA), ref: 604821F9
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,6051440E,00000001,?,?,?,?,?,605142EA), ref: 6048222F

Part of subcall function 604B38D0: AcquireSRWLockExclusive.KERNEL32(?,?,6047D907,?,?,?,?,?,__len <= static_cast<size_type>(numeric_limits<difference_type>::max()),string_view::string_view(_CharT *, size_t): length does not fit in difference_type), ref: 604B38D4

Strings

l[S`, xrefs: 604821AE

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$Acquire$Release
String ID: l[S`
API String ID: 1678258262-3967367481
Opcode ID: c446093e56ff0f5e5ba84502cb972d5d8932cba63717b8a2ddd29f26882767ff
Instruction ID: 1b7a31dd68a524cce864eac3e3d9da490bc8edd9d31020c1b846dafba01397b3
Opcode Fuzzy Hash: c446093e56ff0f5e5ba84502cb972d5d8932cba63717b8a2ddd29f26882767ff
Instruction Fuzzy Hash: 2E41A5B5A006058BDB24DF68D985E6FBBB6BFA5308B10495CE40697340DB39FC05CBD1

Function 604E8218 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 604E848F

Strings

csm, xrefs: 604E8522
csm, xrefs: 604E84B1

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 71a9d4900b7a57cc4740d45f1c3d9d86f0de6e4ff6241c176000c67ce5250164
Instruction ID: df00eb0d16894516a0d402d0ad66f8ad576ad3d97e11296379e9971755e41136
Opcode Fuzzy Hash: 71a9d4900b7a57cc4740d45f1c3d9d86f0de6e4ff6241c176000c67ce5250164
Instruction Fuzzy Hash: A931E372400209BFCF328F52C800DAA7F66FB1535AB18456EF85849260E7BACC61DB91

Function 604A0060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

TryAcquireSRWLockExclusive.KERNEL32(00000000,00000002,FFE00000,?,604A1D50,00000002,FFE00000,?,?), ref: 604A0070
ReleaseSRWLockExclusive.KERNEL32(00000000,?,604A1D50,00000002,FFE00000,?,?), ref: 604A00B5

Strings

bitset reset argument out of range, xrefs: 604A0100

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: bitset reset argument out of range
API String ID: 17069307-1934458321
Opcode ID: 386872758e0c536f2ac6641c2b640dcbaf98708cc2119f30ddb5e35f895f87f3
Instruction ID: 0e0cb0689fb680ea1b876d9e81417856257b7d12fa6a39ad7eb47722b5d5ea7b
Opcode Fuzzy Hash: 386872758e0c536f2ac6641c2b640dcbaf98708cc2119f30ddb5e35f895f87f3
Instruction Fuzzy Hash: 9101263221851857CB389A28AC05FBD3A16EBF3364B624218E513D36E8E779CD42C6C2

Function 604F015E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?,?,?,1N`), ref: 604F0197
GetCurrentDirectoryW.KERNEL32(00000001,00000000,60476EBC,?,?,?,1N`), ref: 604F01CA

Strings

1N`, xrefs: 604F0173

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: CurrentDirectory
String ID: 1N`
API String ID: 1611563598-767462658
Opcode ID: 7a7bac2cd9e53195339a916fe81af58f6d7d6776d5e447bcc79aca3f127ad620
Instruction ID: 16f1643740a8eb5cb9ef19e8f3786478118cbdbe5ac0d9edd3b84d29e8c85a5d
Opcode Fuzzy Hash: 7a7bac2cd9e53195339a916fe81af58f6d7d6776d5e447bcc79aca3f127ad620
Instruction Fuzzy Hash: 170148725002086BE330AB65AC8AE9E7BACDBF2318F11005DF401D7180EF789D4586A4

Function 60490030 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6048FF20: SetFilePointerEx.KERNEL32 ref: 6048FF96

SetEndOfFile.KERNEL32(604869DD), ref: 6049005B

Strings

..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc, xrefs: 604900A4
SetEndOfFile, xrefs: 604900B6

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: File$Pointer
String ID: ..\..\third_party\crashpad\crashpad\util\file\file_io_win.cc$SetEndOfFile
API String ID: 1339342385-359779137
Opcode ID: 2416c2377fc9d81cb26b2b23f6a8f5b52837a13dc653b68a3ef079b9d5b3e0eb
Instruction ID: 440a241fbad3f64132cc106ee85d7907636457b8b272f0a7fac43c500197c9b7
Opcode Fuzzy Hash: 2416c2377fc9d81cb26b2b23f6a8f5b52837a13dc653b68a3ef079b9d5b3e0eb
Instruction Fuzzy Hash: B201B161A442186EFA206A64AC56FAE7F6DDF7224CF014075FD0867281EB295E0986A2

Function 604B8270 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,604AFA8E,?,?,00000001,?,60484216,?,?,?,?,60484052,00000001,00000000), ref: 604B8284
GetProcAddress.KERNEL32(00000000,GetHandleVerifier), ref: 604B8290

Strings

GetHandleVerifier, xrefs: 604B828A

Memory Dump Source

Source File: 0000000E.00000002.3490883533.0000000060451000.00000020.00000001.01000000.00000016.sdmp, Offset: 60450000, based on PE: true

Associated: 0000000E.00000002.3490853439.0000000060450000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491756212.0000000060529000.00000002.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491908614.000000006054A000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006054C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.000000006055C000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3491959000.0000000060564000.00000008.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492083196.0000000060566000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492122559.0000000060572000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492191897.0000000060575000.00000004.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492229716.000000006057D000.00000020.00000001.01000000.00000016.sdmpDownload File
Associated: 0000000E.00000002.3492267357.000000006057E000.00000002.00000001.01000000.00000016.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_60450000_GamePall.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetHandleVerifier
API String ID: 1646373207-1090674830
Opcode ID: 448976192efb63f02c3d1f76e5c2661c2359f41ba7b370207a6edf2707e541f6
Instruction ID: 030dbea7f08889571def9f61bf6f0cbbc5e7b3bf4f1b82e4fa1dd7120957abf8
Opcode Fuzzy Hash: 448976192efb63f02c3d1f76e5c2661c2359f41ba7b370207a6edf2707e541f6
Instruction Fuzzy Hash: E5E06530694715A7DE2867759C4EF553E5AA733701F100868B905E91F0EBF89C81D572

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5GOuTtZoQn.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: SmokeLoader

Threatname: Poverty Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\huge[1].dat

C:\Users\user\AppData\Local\Temp\2DF0.exe

C:\Users\user\AppData\Local\Temp\AD6.exe

C:\Users\user\AppData\Local\Temp\E636.exe

C:\Users\user\AppData\Local\Temp\nsg4CAD.tmp

C:\Users\user\AppData\Local\Temp\nsjB8F5.tmp\liteFirewall.dll

C:\Users\user\AppData\Local\Temp\nsoA0C.tmp\INetC.dll

Windows Analysis Report
5GOuTtZoQn.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre